Cloudflare whacks WAF bypass bug that opened side door for attackers

Cloudflare has fixed a flaw in its web application firewall (WAF) that allowed attackers to bypass security rules and directly access origin servers, potentially enabling data theft or full server takeover, according to DataBreaches[.]Net. FearsOff security researchers reported the bug in October through Cloudflare’s bug bounty program, and the CDN says it has patched the vulnerability in its ACME validation logic with no action required from its customers.

ACME is a protocol that certificate authorities and services like Cloudflare use to automate the issuance, renewal, and revocation of SSL/TLS certificates. According to The Register, more details are available there. This update was published on 21 January 2026.