Cloudflare: an automation script withdraws 25% of BYOIP prefixes from the network

2026-02-20 · Publisher : Cloudflare · Domain : Cloud & DevOps

On 20 February 2026, an empty parameter in a Cloudflare API call causes about 1,100 customer IP prefixes (BYOIP) to be withdrawn, 25% of the total. The incident lasts more than six hours.

What changes

  • About 1,100 BYOIP prefixes, 25%, withdrawn from Cloudflare's network.
  • Cause: a pending_delete parameter with no value, read as "all prefixes to delete".
  • 6 hour 7 minute incident; CDN, Spectrum, Magic Transit and Dedicated Egress affected.
  • "Code Orange: Fail Small" plan: controlled rollouts and circuit breakers.

### Background On 20 February 2026, **Cloudflare** suffered an incident that lasted **6 hours and 7 minutes** according to its post-mortem, starting at 17:48 UTC. An automation in the addressing API was supposed to delete prefixes pending deletion (`pending_delete`). The API client passed this parameter with no value, which produces an empty string: the system then interpreted that **all** returned prefixes were to be deleted, and began systematically deleting BYOIP ("bring your own IP", customer-supplied IP addresses) prefixes and their dependent objects. ### Key facts - About **1,100 BYOIP prefixes**, 25% of the total, were withdrawn from Cloudflare's network. - Timeline: impact began at 17:56 UTC, problem identified at 18:46, mitigation started at 19:11, first customers self-remediated at 19:19 via the dashboard, final configuration updates at 23:03 UTC. - Services affected: CDN and security services, Spectrum, Dedicated Egress, Magic Transit, and the 1.1.1.1 website (not DNS resolution). - Follow-ups: Cloudflare ties its action plan to its "Code Orange: Fail Small" initiative: controlled rollouts for any configuration change, separation of operational and configured state, circuit breakers against overly broad changes. ### Why it matters The incident comes from a missing parameter validation in a delete operation: a malformed request is interpreted as "everything". For platform teams, it is a case to cite when requiring explicit confirmation on destructive operations, limits on the number of objects changeable per call and a dry-run mode. It is also Cloudflare's third major incident in three months, after those of 18 November and 5 December 2025. ### Takeaway An empty parameter was read as "delete everything": destructive operations need volume safeguards.

Links

Tags : Incident, Edge, Cloud