Skipped zeroing let Cloudflare hand back another tenant's blocks
Victoria Shinder2 min readCloudflare has published the anatomy of a cross-tenant data exposure in Cloudflare Containers and in Sandboxes, which is built on Containers. Oren Yomtov of Accomplish reported it through the bug bounty programme on 4 September 2026. The fix is deployed across the fleet and needs no customer-side configuration change.
The mechanism is storage, not code. Containers get a writable root disk from Linux device mapper thin provisioning, presented to a Firecracker virtual machine as /dev/vdc. Thin provisioning allocates physical storage only on first write to an unmapped region, and the affected pools used a 64 KiB thin block with the option skip_block_zeroing set. With zeroing skipped, a reused block that received a write smaller than the full 64 KiB kept the remainder of its previous owner's contents. A customer on a Workers Paid account could recover those residual blocks from the same host.
Cloudflare states the limits plainly: the technique could not be aimed at a chosen customer, workload, host or piece of data, residual data was not guaranteed to be present, and within the historical disk telemetry available the only activity attributable to the technique came from the researchers and from Cloudflare engineers validating it.
What it means
This is a configuration option behaving exactly as documented, in a context where its cost is not obvious. skip_block_zeroing trades a write of zeroes for throughput, which is a reasonable trade inside one trust boundary and a data-exposure bug across several. The same flag is safe on a single-tenant host and unsafe on a shared one, and nothing in the flag says so.
For anyone running multi-tenant workloads on thin pools the check is short: whether zeroing is skipped, and whether blocks are ever returned to a pool shared by tenants. The disclosure is also unusually specific about what the telemetry could and could not show, which is the useful shape for a report like this - the boundary of the evidence stated alongside the finding.