ACME validation flaw patched at the edge
Cloudflare has patched a vulnerability in its ACME (Automatic Certificate Management Environment) validation logic that could have allowed certain requests to bypass WAF processing. The issue was reported by security researchers from FearsOff on October 13, 2025, and validated through Cloudflare’s bug bounty program. There is no evidence of malicious exploitation, and no customer action is required.
How the HTTP-01 challenge works
ACME automates the issuance, renewal, and revocation of SSL/TLS certificates. For domain ownership validation via the HTTP-01 method, a Certificate Authority (CA) expects to find a validation token at the path http://{customer domain}/.well-known/acme-challenge/{token value}.
When a certificate order is managed by Cloudflare, the edge responds on this path with the token provided by the CA. If the token does not correspond to a Cloudflare-managed order, the request is forwarded to the customer origin, since the customer may be completing validation for some other system.
The logic flaw
The vulnerability affected how the edge handled requests to /.well-known/acme-challenge/*. In some cases, the logic serving ACME challenge tokens would disable WAF features on a challenge request and allow it to proceed to the origin when it should have been blocked.
Previously, when Cloudflare was serving a token for an active challenge, the response logic would disable WAF features because those features can interfere with the CA’s ability to validate tokens and cause failures in automated certificate orders and renewals. However, if the token was associated with a different zone and not directly managed by Cloudflare, the request could pass through to the customer origin without further WAF ruleset processing.
The fix
Cloudflare released a code change that only disables the security features when the request matches a valid ACME HTTP-01 challenge token for the hostname — that is, when Cloudflare actually has a challenge response to serve. All other requests continue through normal WAF processing.
The company thanked the external researchers for responsible disclosure and encourages further vulnerability reports through its bug bounty program.
