InfoSecBulletin Cybersecurity for mankind
A critical zero-day flaw in Cloudflare’s Web Application Firewall (WAF) let attackers evade security measures and access protected servers via a certificate validation path.
Security researchers at FearsOff found that requests to the /.well-known/acme-challenge/ directory bypassed customer-configured WAF rules that blocked other traffic.
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.
CAs require websites to serve a one-time token at /.well-known/acme-challenge/{token} for HTTP-01 validation. Most modern websites have this path for automated certificate issuance.
The design intention limits this access to a single validation bot checking one specific file, not as an open gateway to the origin server.
Cloudflare Zero-Day Vulnerability:
FearsOff researchers found the vulnerability while checking apps that restricted access to specific sources. Testing showed that requests to the ACME challenge path evaded WAF rules, enabling direct responses from the origin server rather than Cloudflare’s block page.
To confirm this wasn’t a tenant-specific misconfiguration, researchers created controlled demonstration hosts at cf-php.fearsoff.org, cf-spring.fearsoff.org, and cf-nextjs.fearsoff.org.
Normal requests to these hosts showed block pages, but ACME path requests produced responses from the origin, usually resulting in framework 404 errors.
The vulnerability stemmed from how Cloudflare processed ACME HTTP-01 challenge paths. To avoid disrupting CA validation, Cloudflare turned off WAF features while serving challenge tokens for its managed certificate orders.
However, a critical flaw emerged: if the requested token didn’t match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer origin.
The logic error turned a specific certificate validation issue into a widespread security vulnerability for all hosts protected by Cloudflare.
The bypass allowed researchers to demonstrate multiple attack vectors against common web frameworks. On Spring/Tomcat applications, servlet path traversal techniques using ..;/ accessed sensitive actuator endpoints that exposed process environments, database credentials, API tokens, and cloud keys.
Next.js server-side rendering apps inadvertently shared operational data through direct responses meant for private access.
PHP apps with local file inclusion flaws are now vulnerable, letting attackers access the file system through harmful path parameters. Additionally, WAF rules meant to block requests with custom headers were bypassed for ACME path traffic.
FearsOff reported a vulnerability via Cloudflare’s HackerOne bug bounty on October 9, 2025. Cloudflare started validation on October 13, 2025, and HackerOne assessed the issue on October 14, 2025.
Cloudflare implemented a permanent fix on October 27, 2025, changing the code to disable security features exclusively for valid ACME HTTP-01 challenge tokens related to the specific hostname.
WAF rules now uniformly apply across all paths, including the previously vulnerable ACME challenge route. Cloudflare confirmed no customer action is needed and found no evidence of malicious exploitation.
