{"id":8785,"date":"2026-01-23T09:15:57","date_gmt":"2026-01-23T13:15:57","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=8785"},"modified":"2026-01-23T05:56:07","modified_gmt":"2026-01-23T09:56:07","slug":"when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/","title":{"rendered":"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass"},"content":{"rendered":"<p><span id=\"input-sentence~0\"><a href=\"https:\/\/www.cloudflare.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Cloudflare<\/a> has patched a flaw that let carefully crafted traffic skirt its <a href=\"https:\/\/www.cloudflare.com\/application-services\/products\/waf\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Web Application Firewall<\/a> and reach some customers\u2019 origin servers. The weakness sat in ACME HTTP-01 certificate validation, the behind-the-scenes process that automates SSL and TLS certificate issuance and renewals.<\/p>\n<p>FearsOff researchers <a href=\"https:\/\/fearsoff.org\/research\/cloudflare-acme\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">reported<\/a> the bug through Cloudflare\u2019s bug bounty program in October 2025. This week, Cloudflare confirmed the fix already runs on its edge network, so customers do not need to take action.<\/span><\/p>\n<p><span id=\"input-sentence~1\">ACME proves domain control by asking a certificate authority to fetch a token from a predictable location, typically \/.well-known\/acme-challenge\/&lt;token&gt;. Because strict WAF rules can interfere with that check, Cloudflare\u2019s edge logic sometimes relaxes a set of WAF features while it serves a valid challenge response. That exception aims to keep automated renewals from failing.<\/p>\n<p>However, the researchers found that Cloudflare\u2019s earlier logic did not fully tie the token to the hostname in the request. As a result, a caller could hit the ACME path with a token that existed in <a href=\"https:\/\/hostingdiscussion.com\/news\/cloudflares-2025-internet-review-highlights-growth-colliding-with-security-control\/\">Cloudflare<\/a>\u2019s system but belonged to a different zone. Cloudflare would relax the WAF features, then forward the request to the origin, which let the attacker bypass WAF rules on that route.<\/span><\/p>\n<p><span id=\"input-sentence~2\">In a blog post dated January 19, 2026 and updated January 20, Cloudflare said it pushed a permanent fix on October 27, 2025. The edge now disables those <a href=\"https:\/\/hostingdiscussion.com\/news\/cyber-threat-surge-puts-dns-firewalls-at-the-center-of-global-network-defense\/\">WAF<\/a> features only when the request matches a valid ACME HTTP-01 challenge token for that specific hostname, and only when Cloudflare has the correct challenge response to serve. Cloudflare also said it has not seen evidence that anyone abused the bug before the patch.<\/span><\/p>\n<p><span id=\"input-sentence~3\">Still, the episode highlights an uncomfortable truth about modern web stacks: the odd little maintenance hallway can matter as much as the front door. FearsOff compared the WAF to an entryway and ACME to a corridor meant for a certificate robot, not strangers. Meanwhile, attackers keep automating discovery, so predictable paths and special-case logic can draw attention fast, especially when teams treat the edge as the whole security story.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cloudflare has patched a flaw that let carefully crafted traffic skirt its Web Application Firewall and reach some customers\u2019 origin servers. The weakness sat in ACME HTTP-01 certificate validation, the behind-the-scenes process that automates SSL and TLS certificate issuance and renewals. FearsOff researchers reported the bug through Cloudflare\u2019s bug bounty program in October 2025. This [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[5538,5540,1880,5537,5539,1780],"class_list":["post-8785","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-acme-http-01-challenge","tag-certificate-automation-security","tag-cloudflare","tag-cloudflare-waf-bypass","tag-ssl-tls-certificate-validation","tag-web-application-firewall"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Cloudflare has patched a flaw that let carefully crafted traffic skirt its Web Application Firewall and reach some customers\u2019 origin servers. The weakness sat in ACME HTTP-01 certificate validation, the behind-the-scenes process that automates SSL and TLS certificate issuance and renewals. FearsOff researchers reported the bug through Cloudflare\u2019s bug bounty program in October 2025. This [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-23T13:15:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-23T09:56:07+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/\",\"name\":\"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-01-23T13:15:57+00:00\",\"dateModified\":\"2026-01-23T09:56:07+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/","og_locale":"en_US","og_type":"article","og_title":"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News","og_description":"Cloudflare has patched a flaw that let carefully crafted traffic skirt its Web Application Firewall and reach some customers\u2019 origin servers. The weakness sat in ACME HTTP-01 certificate validation, the behind-the-scenes process that automates SSL and TLS certificate issuance and renewals. FearsOff researchers reported the bug through Cloudflare\u2019s bug bounty program in October 2025. This [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/","og_site_name":"Web Hosting News","article_published_time":"2026-01-23T13:15:57+00:00","article_modified_time":"2026-01-23T09:56:07+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/","url":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/","name":"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-01-23T13:15:57+00:00","dateModified":"2026-01-23T09:56:07+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/when-certificate-checks-turned-into-side-door-cloudflare-shuts-acme-waf-bypass\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"When certificate checks turned into side door: Cloudflare shuts ACME WAF bypass"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":265,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=8785"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8785\/revisions"}],"predecessor-version":[{"id":8786,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/8785\/revisions\/8786"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=8785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=8785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=8785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}