Cloudflare GLM-5.3 leaked other customers' data through a KV cache bug
Original title: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
155 responses from August 27 to September 9 mixed in other users' data; Cloudflare found no deliberate exploitation.
Cloudflare said a tenant-isolation bug in its GLM-5.3 Workers AI deployment returned other customers' session data in 155 responses between August 27 and September 9, 2026. Prompts longer than 681,280 tokens hit a too-small SGLang KV cache; rejected requests still decoded over stale pages. Knostic researcher Gadi Evron reported it on September 8. Cloudflare took the model offline, enlarged the cache, patched rejection handling, and restored it on September 9. No other Workers AI model was affected.
Unconfirmed: Cloudflare says it found no evidence of deliberate exploitation and that affected traffic looked like ordinary use.
- Only prompts longer than 681,280 tokens were affected.
- The prefill pool held 681,280 tokens against a 1,048,576-token window.
- Cloudflare later sized the pool to about 2.04 million tokens.
- SGLang fixes include upstream changes #36988, #38704, and #38935.
- Cloudflare says the volume matches ordinary long-context use, excluding its own and the researcher's tests.
Impact: Other customers' GLM-5.3 session data leaked into responses
| Product | Affected | Fixed in |
|---|---|---|
| Cloudflare Workers AI | GLM-5.3 from August 27 to September 9, 2026 | Restored September 9 after configuration and engine patches |
| SGLang | Disaggregated prefill/decode builds before the cited fixes | #36988 on main; #38704 and #38935 merged |
- Vendors
- CloudflareZ.ai
- Products
- Workers AISGLang
- Organizations
- Knostic
- AI models
- GLM-5.3
From the original article
14 min read at blog.cloudflare.com
A configuration mismatch in GLM 5. 3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. Here is how we addressed the issue.
By Kevin Flansburg · blog.cloudflare.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.