How we mitigated a vulnerability in Cloudflare’s ACME validation logic

On 13 October 2025, security researchers identified a vulnerability in Cloudflare’s ACME (Automatic Certificate Management Environment) validation logic that could disable some WAF features on specific ACME-related paths. The flaw was rooted in how the edge network processed requests intended for the ACME HTTP-01 challenge path, specifically to /.well-known/acme-challenge/*, which could allow challenge requests to bypass certain WAF protections when the token did not relate to a Cloudflare‑managed order.

Cloudflare promptly released a code change to mitigate the issue, ensuring that security features can only be disabled if the request matches a valid ACME HTTP‑01 challenge token for the hostname. The patch means there is no action required by Cloudflare customers, and there have been no reports of malicious exploitation. Cloudflare emphasised vulnerability transparency and thanked external researchers for responsible disclosure, while reiterating that customers remain protected and need not take any steps.