Cloudflare’s container isolation bug came from reused disk blocks

Cloudflare reports that a storage setting let reused container disk blocks retain data from a previous customer. Partial writes replaced only part of each block, leaving old bytes readable. The company restored block clearing and replaced affected disks and cached images. Its postmortem shows why a separate virtual machine does not, by itself, guarantee safe reuse of underlying storage.

Cloudflare · Sep 24, 2026

Why it matters

The cleanup matters as much as the configuration fix when old allocations can survive in caches.

More context

Read this as a storage-isolation case study. Cloudflare says fleet cleanup is complete and customers need no configuration change. Attackers could not select a particular victim or host.

Keep in mind

Cloudflare found no malicious exploitation in its available historical telemetry; that is narrower than proving no exposure ever occurred.

Original read