Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker

Cybersecurity researchers have disclosed a new Spectre-based attack against Cloudflare Workers, demonstrating that a malicious Worker could extract sensitive information from another Worker running on the same physical infrastructure.

During the experiment, researchers were able to recover a JSON Web Token (JWT) from a co-located victim Worker in Cloudflare's production environment.

The demonstrated leakage rate reached approximately 12 bits per second, representing a major improvement over an earlier 2021 attack and showing that speculative-execution side channels remain relevant even in highly optimized cloud isolation environments.

What Is Spectre?

Spectre refers to a class of CPU vulnerabilities involving speculative execution.

Modern processors attempt to improve performance by predicting which instructions will be needed next and executing them before knowing whether those operations are actually required.

When a prediction is incorrect, the processor discards the speculative result.

However, certain side effects — particularly changes to CPU caches — may remain observable.

An attacker can analyze these timing differences to infer data that should otherwise be inaccessible.

Cloudflare itself describes Spectre as a class of attacks in which malicious code can cause a CPU to speculatively process protected data and later infer that information through microarchitectural side effects such as cache behavior.

Why Cloudflare Workers Are an Interesting Target

Cloudflare Workers is a serverless edge-computing platform that allows customers to execute JavaScript and other workloads close to users around the world.

To achieve extremely high density and low latency, Cloudflare uses the V8 JavaScript engine's isolate model.

Multiple Workers belonging to different customers can therefore execute inside the same process while remaining logically separated by V8 isolates.

This architecture provides substantial performance advantages.

However, shared physical processors create a potential problem for microarchitectural attacks.

While software isolation can prevent one Worker from directly accessing another Worker's memory, both workloads may still interact indirectly with shared CPU components such as caches.

Spectre attacks attempt to exploit precisely this type of shared hardware behavior.

Researchers Successfully Extracted a JWT

According to the disclosed research, the attack was able to leak a JWT belonging to another Worker running on the same underlying infrastructure.

JWTs are frequently used for:

• User authentication
• API authorization
• Session management
• Identity claims
• Service-to-service authentication

If an attacker obtains a valid token, the impact depends on the token's permissions and expiration time.

In some environments, a stolen JWT could potentially allow an attacker to impersonate a user or service until the token is revoked or expires.

The important part of the demonstration is therefore not only the specific JWT recovered during testing.

It shows that cross-tenant data extraction through speculative execution remained technically possible under certain conditions.

12 Bits Per Second

The researchers reportedly achieved data leakage rates of up to 12 bits per second.

Although that may initially sound slow, side-channel attacks do not necessarily require high bandwidth.

Credentials, tokens, cryptographic material, and other sensitive secrets can be comparatively small.

A short authentication token may therefore be more valuable to an attacker than large amounts of ordinary application data.

The demonstrated rate was reportedly around 360 times faster than an earlier 2021 attack, illustrating continuing advances in speculative-execution exploitation techniques.

Cloudflare's Existing Spectre Defences

Cloudflare Workers was designed with Spectre-style threats in mind.

One of its most important defensive choices is preventing Workers from obtaining sufficiently precise local timing measurements.

For example, Cloudflare documents that Date.now() does not continuously advance while Worker code executes.

Workers also do not receive unrestricted concurrency features that could easily be converted into high-resolution timers.

This is important because many cache-based side-channel attacks depend on accurately measuring extremely small differences in execution time.

Removing reliable high-resolution timers makes exploitation significantly more difficult.

Cloudflare Adds More Defense-in-Depth

Cloudflare says it has mitigated the demonstrated attack and continues to strengthen the Workers runtime.

Its updated security approach includes additional defence-in-depth mechanisms, including rescheduling Workers in ways intended to increase isolation between potentially suspicious workloads and higher-value workloads.

Cloudflare is also collaborating with researchers from Graz University of Technology (TU Graz), including researchers associated with the original discovery of Spectre, to further evaluate the Workers architecture and its protections against speculative-execution attacks.

Why Secrets Matter in Serverless Environments

Cloudflare Workers can store sensitive values such as API keys and authentication tokens through encrypted Secrets bindings.

Cloudflare recommends using Secrets rather than plaintext variables for sensitive information.

Secrets can be made available to Worker code through the Worker environment while remaining hidden from the dashboard and Wrangler tooling after configuration.

Cloudflare also offers a centralised Secrets Store for account-level secrets, encrypted and distributed across its infrastructure.

However, secret-management systems mainly protect credentials at rest and during normal application access.

A successful microarchitectural attack presents a different challenge because it targets information while it is being processed by a CPU.

The Broader Cloud Security Problem

Spectre-style vulnerabilities are particularly important for cloud platforms because cloud computing depends heavily on sharing physical hardware among multiple customers.

A modern cloud server may simultaneously execute workloads belonging to many unrelated organisations.

Traditional isolation relies on mechanisms such as:

• Virtual machines
• Containers
• Sandboxes
• Processes
• Language runtimes
• V8 isolates

These technologies can provide strong logical separation.

But speculative-execution attacks operate below much of this software stack.

They exploit shared CPU behaviour.

This means cloud providers must defend against attacks not only at the operating-system and application layers but also at the microarchitectural level.