Cloudflare also supports Authenticated Origin Pull, where the request from Cloudflare to the origin server will be authenticated with a client certificate. IIR

Cloudflare also supports Authenticated Origin Pull, where the request from Cloudflare to the origin server will be authenticated with a client certificate. IIRC the same client cert was used for all customers, so the same method allowed you to bypass WAF/access rules etc. even if the victim had authenticated origin pull enabled, as long as the victim didn't validate the host header (which they would't if they used the default setup from the official setup guide). Cloudflare knew about this for many months, possibly a year or multiple years, and I'm not sure if it's fixed or not. I'm not sure CF allows host-rewriting in this scenario. Edit: At least the authenticated origin pull setup guide is unchanged. Not going to verify the entire chain again.