When Agentic Glue Melts: Exploiting Cloudflare Code Mode and Workers

Check Point Research found five memory-corruption vulnerabilities in Cloudflare's workerd runtime used by Cloudflare Workers and Code Mode. Two critical issues enabled a cross-tenant out-of-bounds read (allowing secrets to be leaked from other tenants via the tcmalloc heap) and a zlib use-after-free that can be turned into a sandbox escape to run native code on the host; additional issues include an HTMLRewriter UAF and a KV SQL-bypass deserialization vector. Cloudflare fixed managed Workers in production and advised self-hosted workerd users to upgrade to v1.20260619.1; PoC code was disclosed as part of a Black Hat 2026 presentation.