Nothing escaped — a container was handed a 64 KiB block with the last tenant's bytes still in it, and the duty that fires is documentation, not notification

Cloudflare published its account of a cross-tenant data exposure vulnerability in Cloudflare Containers on 24 September 2026.

Why it mattersFixes the event date. Trade coverage ran 27 September; the provider's own disclosure is 24 September, and the notification clocks anchor to awareness, not to when you read about it.

cloudflare2026how

Oren Yomtov of the Accomplish security research team reported the vulnerability through HackerOne on 4 September 2026 at 15:26 UTC; Cloudflare confirmed the production flaw at 18:45 UTC and merged a runtime fix at 21:27 UTC the same day.

Why it mattersThe processor knew on 4 September. If you are a controller on that infrastructure, that is the date your Article 28(3)(f) request is about.

cloudflare2026how

Rollout of the runtime fix began 4 September 2026 at 23:15 UTC and completed 7 September 2026 at 06:13 UTC; all pre-mitigation cached snapshots were cleared by 19 September 2026 at 15:03 UTC.

Why it mattersAnything your sandboxes wrote before 7 September sat on unmitigated storage; snapshots were only fully cleared on 19 September.

cloudflare2026how

The affected storage pools used Linux device mapper thin provisioning with skip_block_zeroing enabled and 64 KiB block sizes; when a block was reassigned to a new container, a smaller write changed only the written portion and the remainder could retain data from the block's previous owner.

Why it mattersThe isolation people test is execution isolation. This failure is one layer below it, in block allocation, where no application-level test can see it.

cloudflare2026how

The vulnerability would potentially have allowed a customer with a Workers Paid account to recover residual data from storage blocks previously used by other customers' Containers; a 4 KiB write into ext4 free space triggered allocation of a previously used block and a subsequent raw-device read could observe bytes the new container had never written.

Why it mattersThe attacker precondition is a paid account, not an exploit chain. That changes the plausibility of the threat model, not just its severity.

cloudflare2026how

The researchers observed residual material on 18 of 24 placements and 20 of 22 underlying nodes across four continents, and identified 2,700 distinct foreign directory inodes through checksum analysis.

Why it mattersThe measured hit rate is the number to put in your own assessment, because the isolation model predicts zero and the observed value is most of the sample.

cloudflare2026how · bleepingcom2026cloudflar

The recovered blocks included directory structures, database pages and structurally complete SQLite databases.

Why it mattersAgent harnesses persist session state, tool logs and memory as database files. This is the shape of the artefact that came back.

cloudflare2026how

Cloudflare stated it saw no evidence that this specific attack vector was exploited by anyone else, and that remediation does not require any further action by Cloudflare customers.

Why it matters'No evidence of exploitation' is a statement about attackers. 'No further customer action' is true for security and not for Article 33(5).

cloudflare2026how

Cloudflare's post names Cloudflare Sandboxes as built on Cloudflare Containers, a service available on the Workers Paid plan.

Why it mattersThis is the bridge from a storage bug to an agentic one: Sandboxes is where agent-generated code runs.

cloudflare2026how

GDPR Article 33(5) requires the controller to document any personal data breaches, comprising the facts relating to the breach, its effects and the remedial action taken, and provides that the documentation shall enable the supervisory authority to verify compliance with Article 33.

Why it mattersThe duty that actually fires for most readers. It applies to every breach, including the ones you decide not to notify, and the documentation has to let a regulator check that decision.

intersoftco2026article

GDPR Article 33(1) requires notification to the supervisory authority without undue delay and where feasible not later than 72 hours after the controller becomes aware, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons; Article 33(2) requires the processor to notify the controller without undue delay after becoming aware.

Why it mattersThe 72 hours run from the controller's awareness, and the processor's own clock is separate and earlier.

intersoftco2026article

GDPR Article 28(3)(f) requires the processor to assist the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36, taking into account the nature of processing and the information available to the processor; Article 28(3)(h) requires the processor to make available all information necessary to demonstrate compliance and to allow for and contribute to audits.

Why it mattersThis is the lever: assistance is owed, but bounded by the information the processor holds, which is why the request has to be in writing and specific.

intersoftco2026processor

GDPR Article 28(1) requires the controller to use only processors providing sufficient guarantees to implement appropriate technical and organisational measures.

Why it mattersThe due-diligence limb people sign and forget. It is what a regulator reads next to a shared block pool.

intersoftco2026processor

Neither Cloudflare's 24 September 2026 post nor BleepingComputer's 27 September 2026 coverage states that individual affected customers were notified, and neither states that a CVE identifier was assigned.

Why it mattersA documented absence, not a denial. Your assessment has to record what you could not establish and from whom you asked.

cloudflare2026how · bleepingcom2026cloudflar