ACME flaw in Cloudflare allowed attackers to reach origin servers

Cloudflare fixed a flaw in its ACME HTTP-01 validation logic that could let attackers bypass security checks and reach origin servers, according to the article. The issue stemmed from how Cloudflare’s edge handled requests to the /.well-known/acme-challenge/ path, and the company said it found no signs of malicious exploitation.

When WAF rules let the ACME path bypass protections, the trust boundary shifted from the WAF to the origin, with demo apps showing potential exposure of sensitive environment variables and other details. The article notes Cloudflare addressed the flaw on 27 October 2025, restoring consistent WAF enforcement, and cites a report published by FearsOff discussing how header-based risks can arise when headers drive security decisions.

According to the report, AI-driven attacks could later exploit such paths at scale, underscoring the ongoing need for robust WAF protections. The piece was published on 21 January 2026 by Pierluigi Paganini.