Researchers disclosed a working Spectre attack against Cloudflare Workers that extracts JSON Web Tokens from co-located workers at 12 bits per second. The attack exploits speculative execution vulnerabilities in CPU hardware to leak authentication credentials across worker boundaries in Cloudflare's production environment.

The researchers demonstrated the attack using an attacker-controlled worker and victim worker under their supervision. The extraction rate of 12 bits per second represents a 360-fold improvement over a similar attack demonstrated in 2021, making the vulnerability practically exploitable rather than theoretical.

Cloudflare Workers runs customer code in a shared JavaScript runtime environment across global data centers. The Spectre variant leverages timing side-channels in speculative execution to infer memory contents. JWTs serve as authentication tokens that grant access to APIs and services. If extracted, these tokens allow attackers to impersonate legitimate users and access protected resources.

The attack chain requires an attacker to deploy malicious code within Cloudflare Workers alongside a target worker. The shared CPU execution context and insufficient isolation between worker instances enables the timing-based information leak. Once extracted, the JWT provides authentication capabilities equivalent to the compromised user.

The practical extraction speed transforms this from an academic proof-of-concept into a real operational threat. Previous demonstrations achieved speeds too slow for practical credential theft. This attack reaches speeds sufficient to exfiltrate cryptographic material in minutes rather than hours.

Cloudflare has not announced mitigations at the hardware level. CPU manufacturers continue developing microarchitecture defenses against speculative execution attacks, but these remain incomplete. Organizations using Cloudflare Workers should review their secret management practices. Avoid storing long-lived credentials in worker environments when possible. Implement token rotation, short expiration windows, and monitor for suspicious worker behavior. Deploy workers across separate Cloudflare accounts when handling sensitive operations to reduce