Cloudflare Workers Spectre Leaks JWT at 12 Bits/Second

Cybersecurity researchers have demonstrated a remote Spectre attack against Cloudflare Workers that can leak JSON Web Tokens (JWT) from a co‑located worker in production environments at an unprecedented rate of up to 12 bits per second, 360 times the speed of the earliest Spectre demonstration in 2021. The end‑to‑end experiment used two workers—a malicious attacker worker and a victim worker controlled by the researchers—to extract token data through speculative execution side channels ¹.

The attack exploits the same class of CPU vulnerabilities first publicly revealed by Daniel Gruss and Yuval Yilam in 2018. By carefully orchestrating memory access patterns within Cloudflare’s architecture, the researchers bypassed thermal noise limitations that had capped prior demonstrations at roughly one bit every three seconds. This higher throughput means sensitive information could be extracted in minutes rather than hours or days, raising immediate concerns for any service relying on JWTs for authentication or session management.

Beyond JWTs, similar attacks can target other memory regions containing credentials or encryption keys that protect user traffic passing through Cloudflare’s network. In practice, this implies that tokens but also TLS private keys or API secrets stored in shared workers might become vulnerable if the same speculative execution pathways are exploited.

The broader relevance echoes past Intel CPU incidents—Meltdown and Spectre—which required extensive mitigation strategies over several years after their discovery; side channel vulnerabilities persist despite hardware mitigations like Intel's Control-Flow Enforcement Technology (CET) introduced since early 2019.

Cloudflare has not announced a specific fix yet, though it has released general mitigations such as disabling speculative store buffers on affected CPUs. Security specialists warn that until these defenses are fully deployed, users of services hosted on Workers may face an elevated risk of credential compromise.

Developers using Workers should consider token rotation policies, minimal privilege scopes, and monitoring for anomalous read patterns that could indicate exploitation attempts. The new attack demonstrates that privacy threats from speculative execution persist and evolve, demanding continuous vigilance from both cloud providers and application architects.