User location data exposure threatened by Cloudflare CDN vulnerability

Summary: Research reported in January 2025 showed how cached media could reveal a user’s approximate region through the infrastructure serving an application, without decrypting message contents.

Researcher Daniel, publishing as hackermondev, demonstrated the technique with Signal and Discord. Under the tested conditions, media fetched by a device could leave a cache signal at a nearby CDN location; some notification flows required no interaction. These demonstrations did not establish precise street addresses or universal exposure across every app configuration.

The researcher acknowledged that Cloudflare fixed the Workers routing issue used by the original Teleport tool, but described an alternative approach using geographically distributed VPN endpoints. BleepingComputer also published Cloudflare’s statement that the specific datacentre-routing issue had been resolved. That distinction matters: a repaired routing flaw and the wider privacy implications of cache behaviour are separate questions.

CNB Telecom’s practical takeaway

Encryption and network anonymity protect different information. Assess media fetching, notification behaviour and cache design alongside message security. This archive summary describes the January 2025 research; it is not a current test of these services or evidence of an incident affecting CNB systems.

Original sources

• Daniel / hackermondev — original cache-geolocation research
• BleepingComputer, Bill Toulas — January 22, 2025 report and Cloudflare response

Independently summarized and reviewed by CNB Telecom

Archive review: November 4, 2026. Original publication date retained.