Cloudflare BGP Route Leak Caused by Misconfiguration Affects IPv6 Traffic

On January 22, 2026, Cloudflare reported a significant BGP route leak affecting IPv6 traffic, which lasted for 25 minutes. The incident was triggered by an accidental policy misconfiguration on a router, leading to congestion and approximately 12 Gbps of dropped traffic. This leak not only impacted Cloudflare’s customers but also external networks, highlighting the broader implications of such misconfigurations.

The BGP system is crucial for routing data across various networks, and this incident involved the incorrect advertisement of routes learned from peers. Cloudflare’s announcement indicated that the leak was a combination of Type 3 and Type 4 route leaks, which violate established valley-free routing policies. This violation can attract traffic to networks that are not equipped to handle it, resulting in dropped packets and congestion.

Cloudflare quickly detected the issue and reverted the configuration within 25 minutes, stopping further impact. The root cause was linked to a policy change intended to prevent Miami from advertising Bogotá IPv6 prefixes, which inadvertently made the export policy too permissive. This allowed all internal IPv6 routes to be advertised externally, leading to the leak.

While such incidents primarily cause reliability issues, they also pose security risks, as they can facilitate unauthorized traffic interception. Cloudflare has proposed several measures to prevent similar occurrences in the future, including stricter community-based export safeguards and improved early detection mechanisms.

Implications for Cybersecurity

This incident underscores the importance of robust configuration management in network operations. Organizations should be vigilant about policy changes and ensure that any adjustments do not inadvertently compromise routing integrity.

Users and organizations relying on BGP for data routing should monitor their network configurations closely and implement safeguards against potential misconfigurations. Regular audits and automated checks can help identify vulnerabilities before they lead to significant outages or security breaches.

As BGP route leaks can lead to unauthorized traffic interception, it is crucial for organizations to adopt best practices in network security, including the validation of routing policies and the promotion of RPKI ASPA adoption.