Cloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22
SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 model
Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length.
Why this severity: Cross-tenant data exposure in 155 Workers AI responses (Aug 27 to Sep 9); Cloudflare found no deliberate exploitation; no CVE assigned
- Started
- Aug 27, 2026
Affected
- SGLang before v0.5.20 in disaggregated prefill/decode mode (follow-up fixes in v0.5.21 and v0.5.22)
- Cloudflare Workers AI @cf/zai-org/glm-5.3, Aug 27 to Sep 9 2026
Fixed in
- SGLang v0.5.22 (recommended by Cloudflare)
- Cloudflare Workers AI (fixed Sep 9 2026, no customer action)
Timeline6
Cloudflare publishes its report as a coordinated disclosure with the researcher and the SGLang maintainers, recommending all SGLang operators update to v0.5.22 or later.
SGLang v0.5.22 is released, completing the upstream fixes (the core admission fixes #36988 and #38935 shipped in v0.5.20 and v0.5.21).
Cloudflare reproduces the leak, sets the model to private, rolls out a corrected configuration and a patched engine, and restores the model to public at 19:40 UTC.
Gadi Evron of Knostic reports via HackerOne that very long prompts to GLM-5.3 sometimes return text from other users' sessions.
GLM-5.3 launches on Workers AI with a prefill KV pool smaller than its context window; the exposure is present from launch.
The same SGLang engine bug is reported by another user as SGLang issue #30233.
Advisories4
- Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLangCloudflare · Oct 26, 2026
- SGLang v0.5.22 releasesgl-project/sglang · Oct 19, 2026
- SGLang PR #36988: retire aborted prefill requests before their result reaches decodesgl-project/sglang
- SGLang PR #38935: reject over-length requests at admissionsgl-project/sglang
News & write-ups2
Notes & caveats
No CVE has been assigned. Cloudflare says the requests it found are consistent with ordinary long-context use, not repeated exploitation. The core fix (#36988) shipped in SGLang v0.5.20, but Cloudflare recommends v0.5.22 or later for the full set of related KV cache fixes.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
