Acme

• How we mitigated a vulnerability in Cloudflareâ s ACME validation logic 2026-01-19 Hrushikesh Deshpande Andrew Mitchell Leland Garofalo This post was updated on January 20, 2026.

• Security researchers uncovered a flaw in Cloudflare’s ACME HTTP‑01 challenge handling that disabled WAF protections on specific paths. • The vulnerability was reported via Cloudf