Cloudflare discloses a cross-request KV cache leak in GLM-5.3 on Workers AI: a config mismatch plus an SGLang bug let 155 responses carry other users' data over 13 days
In an Oct 26 incident report on its blog, Cloudflare said that between Aug 27 and Sep 9, 155 responses from GLM-5.3 on Workers AI (@cf/zai-org/glm-5.3) to prompts longer than 681,280 tokens contained data from other customers' recent requests, all returned with HTTP 200. The cause was a prefill KV cache pool smaller than the 1,048,576-token context window, combined with an SGLang bug in disaggregated prefill/decode mode. Cloudflare found no evidence of deliberate exploitation, has fixed it, and recommends operators upgrade to SGLang v0.5.22 or later.
Key Takeaways
- Scope: 155 responses between 2026-08-27 and 09-09, all to prompts over 681,280 tokens; Cloudflare confirmed no other Workers AI model was affected
- Cause 1: GLM-5.3 advertised a 1,048,576-token context but the prefill KV pool held only 681,280 tokens; after the fix the pool holds about 2.04 million tokens, roughly twice the context
- Cause 2: SGLang marked over-length requests as rejected and swapped in a one-token placeholder without aborting, so the decode node read stale cache pages from earlier requests
- Response: report from Gadi Evron of Knostic via HackerOne on Sep 8; model taken offline within 40 minutes of declaring the incident on Sep 9 and restored at 19:40 UTC that day
- Action: teams running SGLang should upgrade to v0.5.22 or later and check KV pool size against context length directly
Linked Models & Agents:
