Cloudflare Discloses Cross-Request KV Cache Exposure in GLM-5.3 and Details SGLang Remediation
Frontier AI models · Enterprise AI
Cloudflare reported a security vulnerability in Workers AI affecting the GLM-5.3 model, where prompts exceeding 681,280 tokens could return data from prior customer sessions due to an SGLang disaggregated mode bug and a KV cache misconfiguration. The incident affected 155 responses between August 27 and September 9, 2026. Cloudflare and SGLang maintainers mitigated the flaw by expanding cache capacity and patching upstream request admission logic across releases up to v0.5.22.
On September 8, 2026, security researcher Gadi Evron from Knostic notified Cloudflare of a cross-request KV cache exposure affecting GLM-5.3 on Workers AI. Between August 27 and September 9, 2026, 155 responses to prompts exceeding 681,280 tokens included residual data from earlier user requests. Cloudflare took the model offline on September 9 within 40 minutes of declaring an incident and restored service the same day following configuration changes and engine patches. According to Cloudflare, the exposure stemmed from two overlapping factors. First, Cloudflare deployed GLM-5.3 with a 1,048,576-token context window while its prefill GPU KV cache pool held only 681,280 tokens. Second, an SGLang bug in disaggregated prefill/decode mode allowed prompts exceeding the pool to be replaced with a single-token placeholder while reporting live status to admission queues. As a result, the prefill node transferred only one cache page, while the decode node read across all reserved pages that retained un-zeroed data from prior sessions. Cloudflare adjusted its configuration to expand the prefill pool to approximately 2.04 million tokens and patched SGLang so rejected requests abort at the admission queue before allocation or transfer. Upstream SGLang merged related fixes across releases v0.5.20 through v0.5.22. Cloudflare reported no evidence of deliberate exploitation and confirmed that no other model on Workers AI was affected.
Key takeaways
- A tenant isolation flaw in Workers AI GLM-5.3 affected 155 requests with prompts over 681,280 tokens between August 27 and September 9, 2026, returning text from earlier user sessions.
- The root cause combined an undersized prefill KV cache pool with an SGLang bug that misreported rejected over-length prompts as active, causing decode nodes to read stale GPU memory.
- Cloudflare expanded the prefill KV pool to 2.04 million tokens and introduced an engine patch to terminate rejected requests before cache allocation or transfer occurred.
- Upstream fixes were integrated into SGLang v0.5.20 through v0.5.22, and Cloudflare recommends that all operators utilizing SGLang upgrade to v0.5.22 or later.
Source：blog.cloudflare.com Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human.