Cloudflare Fixes Containers Bug That Leaked Tenant Data

Cloudflare's advisory says the flaw in its Containers and Sandboxes product 'allowed customers with a Workers Paid account to recover residual data from other customers' containers on the same physical host.' Kai Tanner's desk has the mechanism: strip the passive voice and this is a multi-tenant isolation failure. Containers are sold as isolated compute units. The bug meant the isolation boundary was the billing tier, not the sandbox.

It is a known failure class. Destroy a workload, reallocate the physical host, and if ephemeral storage isn't scrubbed between tenants, the next customer inherits the last one's leftovers. Every hypervisor and container runtime vendor claims to have solved this. Cloudflare joins the list of vendors who found out they hadn't, the difference being they found it before anyone reported exploitation in the wild.

That is the good part of this story and also the incomplete part. No CVE, no bounty figure, no timeline for how long the window was open, which means no bank running Workers in this region should file 'patched' as 'audited' until Cloudflare answers what the exposure window actually was. The fix that would have prevented this in the first place is scrubbing ephemeral storage between container lifecycles as a scheduler invariant, not a patch that shows up after someone finds the gap.

Elsewhere tonight, Aya Nakamura's desk has the more consequential filing: a US appeals court let the Pentagon keep Anthropic on its supply chain risk list, the second ruling against the company on the same designation this month, landing in the same quarter Anthropic is negotiating IPO voting control and just signed an 11.6 billion dollar cloud deal with Akamai. The technical case for Claude was never the question. Whether the US government will pay for it now has a published legal record of the Pentagon arguing it shouldn't, twice, and that is a line an IPO prospectus has to disclose, not bury.