InfoSecBulletin Cybersecurity for mankind
A critical zero-day flaw in Cloudflare’s Web Application Firewall (WAF) let attackers evade security measures and access protected servers via a certificate validation path.
Security researchers at FearsOff found that requests to the /.well-known/acme-challenge/ directory bypassed customer-configured WAF rules that blocked other traffic.
CVE-2026-18574
Check Point Authentication Bypass Hits Management Server
TP-Link RCE and SonicWall Zero-Click Flaws Enable Complete Device Compromise
ExfilSquad releases info of over 100,000 UK police officers, staff
CISA alerts to cyberattacks affecting U.S. water utilities
“CyberStrike” AI-Driven Security Platform for Automated Testing
AIDCQ Propose to invest $2 billion in AI data center in Bangladesh
NVIDIA BlueField Flaw Enables Code Execution Attacks
Massive customer data from India’s Bank of Baroda surfaced online
Active Exploits Hit Fortinet, Arista: AI Discovered Linux Kernel Zero-Day
Sam Altman Claims AI “singularity” has arrived, Where Systems Improve by Themselves
The Automatic Certificate Management Environment (ACME) protocol automates SSL/TLS certificate validation by requiring Certificate Authorities (CAs) to verify domain ownership.
CAs require websites to serve a one-time token at /.well-known/acme-challenge/{token} for HTTP-01 validation. Most modern websites have this path for automated certificate issuance.
The design intention limits this access to a single validation bot checking one specific file, not as an open gateway to the origin server.
Cloudflare Zero-Day Vulnerability:
FearsOff researchers found the vulnerability while checking apps that restricted access to specific sources. Testing showed that requests to the ACME challenge path evaded WAF rules, enabling direct responses from the origin server rather than Cloudflare’s block page.
To confirm this wasn’t a tenant-specific misconfiguration, researchers created controlled demonstration hosts at cf-php.fearsoff.org, cf-spring.fearsoff.org, and cf-nextjs.fearsoff.org.
Normal requests to these hosts showed block pages, but ACME path requests produced responses from the origin, usually resulting in framework 404 errors.
The vulnerability stemmed from how Cloudflare processed ACME HTTP-01 challenge paths. To avoid disrupting CA validation, Cloudflare turned off WAF features while serving challenge tokens for its managed certificate orders.
However, a critical flaw emerged: if the requested token didn’t match a Cloudflare-managed certificate order, the request bypassed WAF evaluation entirely and proceeded directly to the customer origin.
The logic error turned a specific certificate validation issue into a widespread security vulnerability for all hosts protected by Cloudflare.
The bypass allowed researchers to demonstrate multiple attack vectors against common web frameworks. On Spring/Tomcat applications, servlet path traversal techniques using ..;/ accessed sensitive actuator endpoints that exposed process environments, database credentials, API tokens, and cloud keys.
Next.js server-side rendering apps inadvertently shared operational data through direct responses meant for private access.
PHP apps with local file inclusion flaws are now vulnerable, letting attackers access the file system through harmful path parameters. Additionally, WAF rules meant to block requests with custom headers were bypassed for ACME path traffic.
FearsOff reported a vulnerability via Cloudflare’s HackerOne bug bounty on October 9, 2025. Cloudflare started validation on October 13, 2025, and HackerOne assessed the issue on October 14, 2025.
Cloudflare implemented a permanent fix on October 27, 2025, changing the code to disable security features exclusively for valid ACME HTTP-01 challenge tokens related to the specific hostname.
WAF rules now uniformly apply across all paths, including the previously vulnerable ACME challenge route. Cloudflare confirmed no customer action is needed and found no evidence of malicious exploitation.
