---
title: "How we mitigated a vulnerability in Cloudflare’s ACME validation logic"
url: https://daily.dev/posts/how-we-mitigated-a-vulnerability-in-cloudflare-s-acme-validation-logic-u8zxtoxa2
source_url: https://blog.cloudflare.com/acme-path-vulnerability/
type: article
source: "Cloudflare"
published: 2026-01-19T14:29:53.610Z
updated: 2026-01-19T14:31:42.040Z
tags: ["security", "vulnerability", "cloudflare"]
reading_time: 3
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# How we mitigated a vulnerability in Cloudflare’s ACME validation logic

**[Cloudflare](https://daily.dev/sources/cloudflare)** · 3 min read · 0 upvotes · 0 comments

## Summary

A vulnerability in Cloudflare's ACME HTTP-01 challenge validation logic allowed certain requests to the /.well-known/acme-challenge/* path to bypass WAF security features. The issue occurred when a request matched a token from a different zone, causing the request to proceed to the origin without WAF processing. Cloudflare patched the vulnerability by ensuring WAF features are only disabled when the request matches a valid challenge token for the specific hostname. No customer action is required, and no malicious exploitation has been detected.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://blog.cloudflare.com/acme-path-vulnerability/>

---

Tags: [#security](https://daily.dev/tags/security), [#vulnerability](https://daily.dev/tags/vulnerability), [#cloudflare](https://daily.dev/tags/cloudflare)

[View this post on daily.dev](https://daily.dev/posts/how-we-mitigated-a-vulnerability-in-cloudflare-s-acme-validation-logic-u8zxtoxa2)