Cloudflare's advisory calls this a vulnerability in Containers and Sandboxes that "allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host." Strip the passive voice and the mechanism is a multi-tenant isolation failure. Containers are marketed as isolated compute units. The bug meant the isolation boundary was the billing tier, not the sandbox.

Residual data recovery from a shared host is a known failure class in container and VM scheduling: destroy a workload, reallocate the physical host, and if ephemeral storage or memory isn't scrubbed between tenants, the next customer inherits the last one's leftovers. It is the multi-tenant cloud's oldest problem, the one every hypervisor and container runtime vendor claims to have solved.

Cloudflare fixed it before anyone reported exploitation. No CVE, no bug bounty payout figure, no timeline for how long the window was open, which means no APAC bank running Workers should treat "patched" as "audited." Ask Cloudflare for the exposure window before filing this one as closed.

The control that would have changed this outcome is scrubbing ephemeral storage between container lifecycles as a scheduler invariant, not a patch applied after someone found the gap.