Threat Overview
Cloudflare disclosed on September 24 that a storage-isolation flaw in Cloudflare Containers could expose residual disk data from a previous customer’s workload to a later workload placed on the same physical host. Cloudflare Containers used Linux device-mapper thin provisioning, and storage blocks were not always zeroed before reuse. Researchers from Accomplish demonstrated cross-tenant recovery. Cloudflare states the same storage system was used by Cloudflare Sandboxes. The vendor began deploying the runtime fix September 4, completed fleet rollout September 7, and completed cleanup of older cached snapshots by September 19.
References
- Cloudflare, September 24, 2026 – How Cloudflare addressed a cross-tenant data exposure vulnerability in Containers
- Independent reporting, September 25, 2026 – Cloudflare Containers cross-tenant data exposure vulnerability
- Accomplish security research, disclosed to Cloudflare through HackerOne on September 4, 2026
Impacted Systems
Cloudflare Containers and Cloudflare Sandboxes before Cloudflare’s fleet remediation. The issue affected Cloudflare-managed multi-tenant infrastructure rather than customer-managed software. Exploitation required a paid Cloudflare Workers/Containers account and placement on shared infrastructure; an attacker could not select a specific victim, host, workload, or data set. Cloudflare reports remediation and cleanup completed by September 19. No customer patch is required.
Why this matters
The flaw crossed a cloud tenant-isolation boundary and could expose residual application data, configuration, database fragments, or credentials. The primary customer question is whether sensitive secrets were stored in affected workloads before remediation.
Exploitation Status
No malicious exploitation is confirmed. Cloudflare states historical telemetry showed activity consistent with the technique only from the authorized researchers and Cloudflare engineers. This is a verified vulnerability disclosure, not an active-attack report.
What this hunt looks for
Downstream credential-use anomalies only when a customer confirms that sensitive credentials or tokens were stored in Cloudflare Containers or Sandboxes during the affected period.
Required logs
Microsoft Entra SigninLogs and AWSCloudTrail can support conditional downstream credential-abuse review. Sentinel does not provide direct visibility into Cloudflare’s underlying storage reuse unless relevant Cloudflare product audit logs or customer-specific evidence are available.
Conditional Hunt – New Entra Source IPs for Potentially Exposed Accounts
let Baseline=SigninLogs
| where TimeGenerated between (ago(30d)..ago(7d))
| where ResultType == 0
| summarize by UserPrincipalName,IPAddress;
SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == 0
| join kind=leftanti Baseline on UserPrincipalName,IPAddress
| project TimeGenerated,UserPrincipalName,IPAddress,Location,AppDisplayName,ClientAppUsed,AuthenticationRequirement,ConditionalAccessStatus
| order by TimeGenerated descConditional Hunt – Successful Entra Sign-Ins Without MFA
SigninLogs
| where TimeGenerated >= ago(7d)
| where ResultType == 0
| where AuthenticationRequirement !~ "multiFactorAuthentication"
| project TimeGenerated,UserPrincipalName,IPAddress,Location,AppDisplayName,ClientAppUsed,AuthenticationRequirement,ConditionalAccessStatus
| order by TimeGenerated descConditional Hunt – Rare AWS Source IPs
let Baseline=AWSCloudTrail
| where TimeGenerated between (ago(30d)..ago(7d))
| summarize by UserIdentityArn,SourceIpAddress;
AWSCloudTrail
| where TimeGenerated >= ago(7d)
| join kind=leftanti Baseline on UserIdentityArn,SourceIpAddress
| project TimeGenerated,UserIdentityArn,SourceIpAddress,EventSource,EventName,AwsRegion,ErrorCode
| order by TimeGenerated descDetection Notes
There is no Sentinel hunt that can prove or disprove exploitation of the Cloudflare storage-layer flaw from ordinary customer telemetry. These queries are intentionally conditional and only make sense if a customer knows Entra or AWS credentials were stored in affected Containers/Sandboxes. They look for downstream use of potentially exposed secrets, not the vulnerability itself. Cloudflare reports the infrastructure issue is remediated and no malicious exploitation was found.
