"When Agentic Glue Melts": Five workerd Memory-Corruption Flaws Enable Cross-Tenant Secret Theft and Code Mode Sandbox Escape on Cloudflare Workers — Threadlinqs Intelligence
As of 2026-08-07, "When Agentic Glue Melts": Five workerd Memory-Corruption Flaws Enable Cross-Tenant Secret Theft and Code Mode Sandbox Escape on Cloudflare Workers is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-1924 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
Check Point Research disclosed five vulnerabilities in workerd, the runtime behind Cloudflare Workers and Cloudflare Code Mode: a URLPattern out-of-bounds read (two variants), a zlib deflateParams()
Check Point Research researchers Yarden Porat and Shahar Tal presented "When Agentic Glue Melts: Exploiting Cloudflare CodeMode and Workers" at Black Hat USA 2026 (Mandalay Bay, Las Vegas, August 6, 2026, 3:35 PM PT), detailing five memory-corruption and logic flaws in workerd, the open-source JavaScript/WebAssembly runtime that underlies both the Cloudflare Workers serverless platform and Cloudflare Code Mode (a feature that exposes Worker bindings to LLM agents as a typed TypeScript API the model writes and executes code against, rather than emitting sequential structured tool calls).
The five root causes: (1) a URLPattern out-of-bounds read caused by a nested-capture-group count mismatch between workerd's parser and V8's regex engine — a pattern such as `/(ab(cde))/` produces two capture groups in V8's regex engine but is counted as one by workerd's URLPattern group list — exploitable in both the original and Ada-backed URLPattern implementations, that yields an arbitrary-memory-read primitive by treating out-of-bounds bytes as a kj::String (pointer+size+disposer); (2) a use-after-free write in the node:zlib binding's deflateParams(), where the z_stream structure retains a stale next_out pointer after write() completes, so a subsequent params() call flushes buffered output through the dangling pointer into freed memory whose output-offset parameter allows targeting an exact field within the reused object (rated Critical by Cloudflare); (3) a use-after-free read in HTMLRewriter's AttributesIterator, which holds a raw pointer into an element's attribute array that is freed on reallocation when setAttribute() calls grow the array beyond capacity, surfacing on the iterator's next next() call (rated Critical by Cloudflare); (4) a Durable Objects SQL-authorizer bypass that validates table names in queries but not in ALTER TABLE RENAME TO, letting an attacker create a table under a permitted name, populate it with crafted bytes, and rename it into the protected _cf_KV namespace; and (5) an arbitrary-deserialization flaw reachable through that authorizer bypass, where the crafted bytes reach workerd's internal V8 deserializer, which is built for trusted input only.
Two exploit chains were demonstrated. The cross-tenant secret-theft chain deploys a malicious Worker into a shared compute pool, calls pattern.exec() on the crafted nested-group regex to trigger the URLPattern OOB read, constructs a fake kj::String from freed tcmalloc chunks to leak a real heap address, defeats ASLR by reading tcmalloc free-list "next" pointers, shapes the heap using VFS file allocations to place attacker-controlled data adjacent to target objects, and abuses in-place VFS file-content modification (no reallocation) to build a repeatable read primitive that sweeps a co-located tenant's heap for strings matching the API-token pattern `Bearer sk…`. This works because, per Cloudflare's own confirmation, the tcmalloc heap sits outside both the V8 sandbox ("cage") and hardware memory-protection keys, so a read primitive that escapes V8 isolation also escapes cross-tenant memory protection. The Code Mode sandbox-escape chain begins with prompt injection steering an LLM agent into generating attacker-controlled TypeScript that Code Mode executes; the script calls handle.write() with Z_NO_FLUSH to leave compressed data pending, then calls handle.params() to trigger deflateParams(), flushing through the stale next_out pointer into a freed slot holding FileImpl metadata; the UAF write corrupts that FileImpl's data.size field to inflate its bounds, yielding out-of-bounds file read/write that is used to corrupt a second FileImpl's data.ptr field, achieving an arbitrary process-memory read/write primitive via the second file's API; the exploit then writes ARM64 shellcode into V8's fixed RWX region at address 0xaaaaf0000000 and hijacks the zlib stream's native write-callback pointer so that a further handle.write() call redirects execution into the shellcode (Check P
Weaknesses (CWE)
CWE-416, CWE-125, CWE-502, CWE-863
Timeline
- Check Point Research reports four workerd vulnerabilities (zlib deflateParams() UAF, HTMLRewriter AttributesIterator UAF, and two URLPattern out-of-bounds read variants) to Cloudflare via HackerOne.
- Cloudflare rates the zlib deflateParams() use-after-free and the HTMLRewriter AttributesIterator use-after-free as Critical severity.
- Check Point Research reports the fifth vulnerability, the Durable Objects KV SQL-authorizer bypass enabling arbitrary deserialization.
- workerd v1.20260619.1 is released, fixing all five vulnerabilities for self-hosted deployments; Cloudflare's managed Workers platform is patched in production ahead of this release.
- Check Point Research presents "When Agentic Glue Melts: Exploiting Cloudflare CodeMode and Workers" at Black Hat USA 2026 (Mandalay Bay, Las Vegas), publicly disclosing the full exploit chains.
- Check Point Research publishes five standalone proof-of-concept exploits (WhenAgenticGlueMeltsPOCs), one per vulnerability, on GitHub alongside the Black Hat presentation.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1190, T1059.007, T1611, T1620, T1212, T1005, T1587.004, T1588.005
