How Cloudflare addressed a cross-tenant data exposure security flaw in Containers

What happened

On September 4, 2026, Oren Yomtov, a security researcher from Accomplish , responsibly reported a vulnerability affecting Cloudflare Containers and Cloudflare Sandboxes (which is built on Containers), through Cloudflare’s bug bounty program . Cloudflare Containers run workloads on multi-tenant infrastructure and automatically assign them to eligible servers; customers cannot select the underlying host.

Cloudflare applied a fix across the Containers fleet, with no customer-side configuration changes required. How container storage allocation works Cloudflare Containers use Linux device mapper thin provisioning (dm-thin) to provide each container with a writable root disk.

Each container lives inside a dedicated virtual machine powered by the Firecracker virtual machine monitor. Firecracker presents this disk to the virtual machine as /dev/vdc.