Yes, a Cloudflare customer could potentially use Cloudflare’s own shared infrastructure to reach another customer’s origin under two configurations described by security consultancy Certitude. The researchers demonstrated a proof-of-concept bypass involving shared Authenticated Origin Pulls certificates and origin firewalls that trusted Cloudflare IP ranges. Their disclosure did not establish a real-world victim, successful attack, or compromise of Cloudflare’s network.
What Certitude reported
Cloudflare normally sits between visitors and a customer’s origin server. Web Application Firewall (WAF) rules and other edge controls inspect traffic before it is forwarded. The origin must then accept requests only from an appropriately trusted source.
As an Amazon Associate I earn from qualifying purchases.
Certitude’s finding was that some origin-hardening configurations trusted Cloudflare infrastructure in general, rather than verifying that traffic came through the protected customer’s own zone or hostname. A separate Cloudflare tenant could configure a domain pointing to the victim’s origin and send requests through Cloudflare while leaving protections disabled on the attacker-controlled domain.
As Certitude put it in its September 28, 2023 disclosure, “During our analysis, we found that two proposed mechanisms are based on the premise, that all traffic to the origin server originating from Cloudflare is to be trusted, while traffic from other parties is to be rejected.”
#1 Best Overall
- Quad Core J3710 Processor: F3 firewall hardware with Pentium J3710 Processor, 4 Cores 4 Threads, 2M Cache, up to 2.64 GHz, TDP 6.5 W. Compatible with OPNsense, Linux, ESXi, Proxmox
- 4 x i225V 2.5GbE LAN: J3710 mini pc with 4 x i225V 2500Mbps LAN, can monitor network data, improve network security, powerful and widely used
- DDR3 RAM mSATA Slot: J3710 firewall pc with 1 x DDR3L SO-DIMM memory, 1 x mSATA SSD slot, 1 x SATA 3.0 slot(SATA Cable included), 1 x Mini-PCIe Slot
- HD DP Dual Display: Micro firewall appliance J3710 integrated HD Graphics, HD + DP dual display interfaces improve work efficiency
- Fanless Mini Size: Firewall appliance J3710 with aluminium alloy body, fanless quiet running without noise. Size only 11 x 10 x 3.5 cm
This is a cross-tenant trust-boundary problem, not a claim that Cloudflare’s entire network was breached.
How the demonstrated bypass worked
Shared Authenticated Origin Pulls certificate
Authenticated Origin Pulls (AOP) uses a client certificate when Cloudflare connects to an origin over HTTPS. If the origin accepts Cloudflare’s shared certificate, it can verify that the connection came from Cloudflare’s network, but not necessarily which Cloudflare customer or zone initiated it.
Certitude said an attacker-controlled Cloudflare domain could therefore present the same shared certificate when connecting to an origin that trusted it. The victim’s hostname might block a crafted request with WAF rules, while the attacker’s hostname—configured to the same origin address—could forward that request without those victim-specific rules.
Recommended Free Tools
Rank #2
- 【Processor & OS】Firewall Mini PC with Intel J4105 CPU up to 2.5GHz, 4Cores4threads 4MB L2 Cache, TDP 10w, supports AES-NI. It tested with pf-sense linux ubuntu and other popular open source OS. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel 2.5GbE I226 lan ports, 2 * USB3.0 ports, 1 * VGA port, 1 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【DDR4 RAM & mSATA SSD】The firewall router equipped with 8G DDR4 RAM, max support 16GB; 240GB mSATA SSD equipped, can be up to 512GB. Not support HDD.
- 【Fanless Design】The small firewall box is only small but powerful. Low power consumption, only 10W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, support 24/7 hours working, no noise. Fanless mini PC, silent, with heat dissipation through the casing, which can withstand temperatures up to 60°C
- 【12 Months Service】You will get 1*mini pc，size:5.27 * 4.98 * 1.43 in weigh:500g. If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
Certitude recommended a customer-specific certificate. Cloudflare’s current guidance likewise says uploading your own certificate provides stricter security than the certificate Cloudflare supplies, although certificate deployment and renewal require additional operational work.
Allowlisting Cloudflare IP ranges
Many origins block direct internet traffic and allow only Cloudflare’s published IP ranges. That prevents ordinary external systems from connecting directly, but Cloudflare’s egress is shared. An attacker who is also a Cloudflare customer may be able to send traffic from that trusted network path.
Cloudflare’s current documentation rates IP allowlisting as “Moderately secure” and identifies IP spoofing as a challenge. An allowlist answers “did this connection come from a Cloudflare address?” It does not answer “which Cloudflare tenant sent it?”
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
The proof of concept is not an incident report
Certitude configured an attacker-controlled Cloudflare domain to point at the same origin IP as a victim domain. The victim’s Cloudflare configuration blocked a crafted request; the attacker-controlled configuration forwarded it. That demonstrates a possible configuration path, but it does not prove that an unknown attacker used it against a customer.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Disclosure timeline and severity
- March 16, 2023: Certitude reported the issue to Cloudflare through HackerOne.
- Initial response: Cloudflare closed the report as “Informative,” according to Certitude’s timeline.
- September 28, 2023: Certitude publicly disclosed its findings and proof of concept.
- October 4, 2023: Certitude said Cloudflare changed the severity to High, with a 7.5 rating, and announced documentation and dashboard changes.
The 7.5 figure is a severity score, not a count of affected customers or confirmed attacks. The available disclosure accounts do not establish exploitation, a named victim, or customer impact.
What Cloudflare recommends now
Cloudflare’s “Protect your origin server” documentation, last updated April 20, 2026, presents several controls. They differ in how specifically they authenticate a tenant, whether the origin remains publicly reachable, availability by plan, and maintenance effort.
Rank #4
- 【Processor & OS】Firewall Mini PC with Intel J3710 CPU up to 2.64GHz, 4Cores 4threads 2MB L2 Cache, TDP 6.5w, supports AES-NI. It tested with pf-sens/opn-sense linux ubuntu and other popular open source os. ("DEL" key to enter BIOS)
- 【Interfaces】The firewall pc has 4 * Intel I226 lan ports, 2 * USB3.0 ports, 1 * RS232COM port, 2 * HD port, 1 * DC port. Equipped with VESA mount, you can install the micro pc behind the monitor to save space.
- 【Fanless Design】only 6.5W; fanless heat dissipation design, aluminum alloy shell, efficient and fast heat dissipation, which can withstand temperatures up to 60°C. support 24/7 hours working, no noise.
- 【RAM & Storage】The firewall router equipped with 8G DDR3 RAM, max support 8GB; 128GB mSATA SSD, up to 512GB. Not support HDD. Size:5.27 * 4.98 * 1.43 inches, Weigh:500g, small but powerful.
- 【12 Months Service】You will get a firewall pc and accessories，If you encounter any problems during the use, please contact us through Amazon, we have a professional and efficient team dedicated to serving you.
| Control | Tenant-specific? | Public origin route | Availability and effort | Important limitation |
|---|---|---|---|---|
| Customer-uploaded Authenticated Origin Pulls certificate | Yes, when configured for the customer’s own certificate | Usually yes | Available to all customers; requires certificate setup and ongoing management | Cloudflare says its shared certificate only proves traffic came from the Cloudflare network |
| Cloudflare Tunnel | Uses an outbound tunnel associated with the deployment | No publicly routable origin is required | Available to all customers; requires installing and operating cloudflared |
Introduces daemon deployment, monitoring, and availability considerations |
| HTTP header or Host-header validation | Can be tenant- or application-specific if enforced correctly | Usually yes | Available through origin/server configuration; application changes may be required | Basic authentication can be replayed, and some valid product configurations can override Host headers |
| Cloudflare IP allowlisting | No | Yes | Available to all customers; straightforward firewall rule | Shared Cloudflare egress does not identify the originating tenant; Cloudflare labels it moderately secure |
| Dedicated egress IPs | More narrowly attributable to an account | Yes | Cloudflare currently describes this through Smart Shield Advanced; Enterprise-only and requires network-level firewall policies | Product packaging and eligibility can change; verify current Cloudflare terms |
Should you use a custom AOP certificate?
If your origin currently trusts Cloudflare’s shared AOP certificate, a customer-uploaded certificate is the more tenant-specific choice described in the current guidance. It narrows the authentication decision from “Cloudflare network” to a certificate you control.
Plan for certificate issuance, installation, renewal, rotation, and coverage across every origin. Cloudflare notes that this can be harder to scale across many origins. A custom certificate should complement—not replace—application authentication, host validation, restrictive firewall rules, logging, and monitoring.
Why hiding the origin still matters
Authentication controls are weaker if attackers can discover and connect to an old origin address directly. Cloudflare advises reviewing DNS-only records that expose origin IPs and rotating origin IP addresses after onboarding, because historical DNS records may reveal previous addresses. Restricting direct access also reduces attack paths that do not involve Cloudflare at all.
Best Value
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
A practical hardening sequence
- Inventory exposure: Find every origin address, DNS-only record, staging host, and legacy address associated with the application.
- Remove unnecessary reachability: Hide the origin where possible. Consider Cloudflare Tunnel when an outbound-only connection fits the application.
- Replace shared trust: Configure a customer-specific AOP certificate, or enforce a strong per-application authentication mechanism at the origin.
- Validate host and headers: Ensure the origin accepts only the expected hostname and rejects unexpected Host-header values. Test legitimate product flows that may rewrite headers.
- Keep IP rules as defense in depth: Allowlisting Cloudflare ranges can block direct connections, but do not treat it as tenant authentication.
- Use narrower egress when justified: Enterprises that need network-level attribution can evaluate dedicated egress IPs and corresponding firewall policies.
- Test from outside the protected path: Confirm that a request sent through an alternate Cloudflare hostname, a stale DNS record, or a direct origin address is rejected and logged.
- Rotate after changes: Replace exposed origin addresses and update all dependent systems once the new controls are verified.
What this means for Cloudflare customers
The disclosure matters most to customers whose origin accepts any Cloudflare connection without a second, customer-specific check. A WAF policy on the victim’s hostname does not protect traffic that reaches the origin through another hostname or route and therefore never encounters that policy.
Customers using Cloudflare should review AOP certificate selection, origin firewall rules, DNS history, Host-header handling, and whether their plan supports Tunnel or dedicated egress. The right design depends on the application, number of origins, certificate-management capacity, and acceptable operational complexity.
Quick Recap
What is not established
- No reviewed source confirms that attackers exploited this path against a real Cloudflare customer.
- No source identifies a victim, breach, data theft, or service outage caused by the finding.
- No source quantifies how many customers used the implicated configurations or were vulnerable.
- The disclosure does not show a compromise of Cloudflare’s underlying network; it describes abuse of trust between tenants sharing that network.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
