rewindex

CompaniesContentfulIncidents

Contentful: Cloudflare incident status update

No impact listedStatus: resolvedStarted Resolved (0 min)1 updatewww.contentfulstatus.com (opens in new tab)

Timeline of updates

  1. resolved

    This update is meant to give a security status assessment updated with all information we could collect on this incident, as of Friday the 24th of February 13:17 UTC. One of the biggest global CDN providers had a severe security issue [1][2] which exposed private user data and credentials to the outside world. The full scope of the issue is not yet fully clear. We have reviewed the services used by Contentful according to a public list [3] of potentially compromised web applications. The only service in this list we are aware of using is Zendesk, whose security staff have assured us that no credentials were leaked on their side. Contentful itself is NOT using Cloudflare to provide its services, so no data was leaked from Contentful. We recommend the following: * To rotate Contentful API Keys that transited through Cloudflare systems (i.e. if you are a customer of Cloudflare and use their product to protect a proxy to the Contentful API) * Should you be using the same password to access Contentful that you use on other services, we recommend that you change it and use a password that is unique and used only for Contentful. We will be monitoring the situation and will update accordingly if something changes. [1]: https://blog.cloudflare.com/incident-report-on-memory-leak-caused-by-cloudflare-parser-bug/ (opens in new tab) [2]: https://techcrunch.com/2017/02/23/major-cloudflare-bug-leaked-sensitive-data-from-customers-websites/ (opens in new tab) [3]: https://github.com/pirate/sites-using-cloudflare (opens in new tab)

From Contentful’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.

How the archive is checked, and what it cannot prove.

This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.

Impact, status and times are the vendor’s own, as last archived. View on www.contentfulstatus.com (opens in new tab).

Cite this

Status incident (vendor impact label: none) posted by Contentful, started 2017-02-24 13:44 UTC, resolved after 0 min, 1 update(s).

Title
Cloudflare incident status update
Vendor
Contentful
Date
URL
https://rewindex.com/company/contentful/incidents/lcs2blvf73gt

Contentful profileRecent Contentful incidentsAll outages on February 24, 2017Contentful in February 2017MarkdownJSON