Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
- ID
- 39777
- Status
- summarized
- Published
- 27 Oct 2026, 6:01 AM
- Fetched
- 27 Oct 2026, 8:05 AM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/kv-cache-exposure-remediation/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 7.5
- Created
- 27 Oct 2026, 8:05 AM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
Cloudflare disclosed that between August 27 and September 9, 2026, a tenant isolation bug in the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3) returned other customers' data in 155 responses, all to prompts longer than 681,280 tokens. The root cause was two overlapping issues: GLM 5.3 was deployed with a 1,048,576-token context window while the prefill GPU KV cache pool held only 681,280 tokens, and SGLang mishandled the resulting over-length requests in disaggregated prefill/decode mode by internally marking them rejected and replacing them with a one-token prompt instead of erroring. The issue was reported September 8 by Gadi Evron of Knostic via HackerOne, reproduced the next morning, and the model was taken offline within 40 minutes of the incident being declared and restored the same day; Cloudflare says no other Workers AI model was affected and found no evidence of deliberate exploitation.
Why it matters
If you call Workers AI models with very long contexts, or self-host SGLang in disaggregated prefill/decode mode, the concrete lesson is that a context-window value larger than your KV cache pool size is not a safe configuration — Cloudflare shipped that mismatch knowingly and relied on the engine to error out, which it did not. Before your next long-context deployment, verify the cache pool actually covers the advertised context length and test what your engine does with an over-length prompt: an explicit error is fine, a silent substitution is a cross-tenant leak.
Discussion angle
What does your inference stack do when a prompt exceeds the KV cache pool — error, truncate, or silently swap in something else? Worth walking through how you'd test that in your own setup, and whether you'd have caught it before a researcher did.