Cloudflare Workers Vulnerable to Spectre Attack Leaking JWT Tokens

Researchers have demonstrated a working attack against Cloudflare Workers that exploits the Spectre vulnerability to steal authentication tokens from neighboring applications running on the same hardware. The attack works by leveraging CPU cache timing differences—a technique that has haunted processor design since Spectre became public knowledge in 2018. What makes this particular discovery significant is that it shows the vulnerability isn't merely theoretical in the serverless context; attackers can extract JSON Web Tokens, or JWTs, at a rate of 12 bits per second from co-located worker instances.

Cloudflare Workers is a platform that allows developers to run code at the edge of Cloudflare's global network, closer to end users. The service is built on shared infrastructure, meaning many different customers' applications run on the same physical machines. This multi-tenant model is central to the platform's efficiency and cost structure, but it also creates a potential security boundary that needed to hold. The researchers found it does not.

The attack works by having a malicious worker instance probe the CPU cache to infer what data a neighboring worker is accessing. By measuring the time it takes to retrieve information from memory, an attacker can determine whether that data is cached—and therefore what secrets a co-located application might be holding. JWTs are particularly valuable targets because they often contain authentication credentials that grant access to backend systems and user data. Once extracted, a stolen token could allow an attacker to impersonate the legitimate application.

The 12 bits-per-second extraction rate, while slow, is fast enough to be practical. A typical JWT might be several hundred characters long, meaning an attacker could potentially steal a complete token in under a minute of continuous probing. The attack requires the attacker to maintain a worker instance running alongside the target, but given how inexpensive and easy it is to deploy code to Cloudflare Workers, this is not a significant barrier.

This discovery sits at the intersection of two long-standing security challenges. Spectre itself has proven remarkably difficult to fully patch because it exploits fundamental properties of how modern CPUs work—specifically, their tendency to speculatively execute instructions and cache results before confirming those instructions should have run. Mitigations exist but often come with performance costs that chip manufacturers and operating system designers have been reluctant to fully implement. The second challenge is the inherent tension in serverless computing: the entire value proposition depends on packing many customers' code onto shared hardware, but that density creates opportunities for one tenant to spy on another.

Cloudflare has not yet issued a public statement about the vulnerability or any patches. The company does offer some isolation mechanisms between workers, but the research suggests these may not be sufficient against a determined attacker with knowledge of Spectre techniques. Other serverless platforms—Amazon Lambda, Google Cloud Functions, Microsoft Azure Functions—likely face similar risks, though the specific implementation details vary.

The discovery will probably accelerate conversations within the industry about stronger isolation models. Some possibilities include running each worker in a separate container or virtual machine, which would eliminate the shared cache that Spectre exploits, though this would increase latency and cost. Another approach involves using specialized CPU instructions or microcode updates to prevent the speculative execution that enables the attack in the first place. For now, the research serves as a reminder that the convenience of serverless computing comes with security tradeoffs that are still being discovered and understood.