Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers

Cloudflare has fixed an ACME validation flaw that could bypass security controls and reach origin servers via the ACME HTTP-01 path. The vulnerability was discovered and reported by FearsOff in October 2025, and Cloudflare addressed it on 27 October 2025, with a code change that serves the response and disables WAF features only when the request matches a valid ACME HTTP-01 challenge token for that hostname, according to Cloudflare.

The flaw related to how Cloudflare’s edge network processed requests destined for the ACME path, potentially allowing an attacker to bypass WAF protections and access the origin server, though the company said there was no evidence of exploitation. The guidance notes that ACME validates domain ownership via challenges to issue, renew, and revoke SSL/TLS certificates, and that Cloudflare’s fix ensures WAF rules are not disabled for tokens associated with different zones or non-Cloudflare‑managed orders.

Kirill Firsov of FearsOff warned the vulnerability could enable deterministic, long‑lived tokens and access to sensitive files on origin servers across Cloudflare hosts, a claim reported by the researchers.