# Cloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22 · pwn.watch > Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length. Page: https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak · generated 2026-10-30T19:26:38.232Z ## Status - Severity: high · status: live · patch: patched - Product: SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 model - Started: 2026-08-27 - Affected: SGLang before v0.5.20 in disaggregated prefill/decode mode (follow-up fixes in v0.5.21 and v0.5.22); Cloudflare Workers AI @cf/zai-org/glm-5.3, Aug 27 to Sep 9 2026 - Fixed in: SGLang v0.5.22 (recommended by Cloudflare); Cloudflare Workers AI (fixed Sep 9 2026, no customer action) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak/feed.xml - JSON Feed: https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak.json - This file: https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak/llms.txt ## Updates (newest first) - 2026-10-26: Cloudflare publishes its report as a coordinated disclosure with the researcher and the SGLang maintainers, recommending all SGLang operators update to v0.5.22 or later. (https://blog.cloudflare.com/kv-cache-exposure-remediation/) - 2026-10-19: SGLang v0.5.22 is released, completing the upstream fixes (the core admission fixes #36988 and #38935 shipped in v0.5.20 and v0.5.21). (https://github.com/sgl-project/sglang/releases/tag/v0.5.22) - 2026-09-09: Cloudflare reproduces the leak, sets the model to private, rolls out a corrected configuration and a patched engine, and restores the model to public at 19:40 UTC. (https://blog.cloudflare.com/kv-cache-exposure-remediation/) - 2026-09-08: Gadi Evron of Knostic reports via HackerOne that very long prompts to GLM-5.3 sometimes return text from other users' sessions. (https://blog.cloudflare.com/kv-cache-exposure-remediation/) - 2026-08-27: GLM-5.3 launches on Workers AI with a prefill KV pool smaller than its context window; the exposure is present from launch. (https://blog.cloudflare.com/kv-cache-exposure-remediation/) - 2026-07-06: The same SGLang engine bug is reported by another user as SGLang issue #30233. (https://github.com/sgl-project/sglang/issues/30233) ## Fix brief # Security brief: Cloudflare Workers AI's GLM-5.3 returned other customers' data in 155 responses after an SGLang KV cache bug; SGLang operators should update to v0.5.22 Source: https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak · status: live · severity: high · updated Oct 30, 2026, 15:15 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Between Aug 27 and Sep 9 2026, Cloudflare's GLM-5.3 model on Workers AI (@cf/zai-org/glm-5.3) sometimes answered very long prompts with data from other customers' recent requests to the same model, Cloudflare disclosed on Oct 26. 155 responses were affected, all to prompts longer than 681,280 tokens. Two issues combined: Cloudflare launched the model with a 1,048,576-token context window but a prefill KV cache pool that held only 681,280 tokens, and SGLang, the open-source inference engine it uses, mishandled over-length requests in disaggregated prefill/decode mode. Instead of returning an error, it swapped the prompt for a one-token placeholder, transferred one KV page, and let the decode node attend over stale cache pages still holding earlier users' prompts and partial generations, returning HTTP 200. Researcher Gadi Evron of Knostic reported it via HackerOne on Sep 8; Cloudflare took the model offline on Sep 9, fixed its configuration and engine, and restored it the same day. It found no evidence of deliberate exploitation and says no other Workers AI model was affected, so Cloudflare customers have nothing to do. Anyone running SGLang in disaggregated prefill/decode mode should update to v0.5.22 or later (or backport #36988 and #38935) and check that each node's KV pool is at least as large as the context length. Severity detail: Cross-tenant data exposure in 155 Workers AI responses (Aug 27 to Sep 9); Cloudflare found no deliberate exploitation; no CVE assigned - Product: SGLang inference engine (disaggregated prefill/decode mode); Cloudflare Workers AI GLM-5.3 model ## Affected versions - SGLang before v0.5.20 in disaggregated prefill/decode mode (follow-up fixes in v0.5.21 and v0.5.22) - Cloudflare Workers AI @cf/zai-org/glm-5.3, Aug 27 to Sep 9 2026 ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - SGLang v0.5.22 (recommended by Cloudflare) - Cloudflare Workers AI (fixed Sep 9 2026, no customer action) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Cloudflare Workers AI customers need to do nothing. If you self-host SGLang in disaggregated prefill/decode mode, upgrade to v0.5.22 or later (pip install -U 'sglang>=0.5.22'), or backport PRs #36988 and #38935. After any change to weights, quantization, parallelism or memory fraction, compare each prefill and decode node's KV pool size (printed in the SGLang startup log) with the configured context length, and lower the context length if the pool is smaller. ## Latest updates - Oct 26, 2026: Cloudflare publishes its report as a coordinated disclosure with the researcher and the SGLang maintainers, recommending all SGLang operators update to v0.5.22 or later. - Oct 19, 2026: SGLang v0.5.22 is released, completing the upstream fixes (the core admission fixes #36988 and #38935 shipped in v0.5.20 and v0.5.21). - Sep 9, 2026: Cloudflare reproduces the leak, sets the model to private, rolls out a corrected configuration and a patched engine, and restores the model to public at 19:40 UTC. - Sep 8, 2026: Gadi Evron of Knostic reports via HackerOne that very long prompts to GLM-5.3 sometimes return text from other users' sessions. - Aug 27, 2026: GLM-5.3 launches on Workers AI with a prefill KV pool smaller than its context window; the exposure is present from launch. - Jul 6, 2026: The same SGLang engine bug is reported by another user as SGLang issue #30233. ## Advisories - [Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang](https://blog.cloudflare.com/kv-cache-exposure-remediation/) (Cloudflare) - [SGLang v0.5.22 release](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) (sgl-project/sglang) - [SGLang PR #36988: retire aborted prefill requests before their result reaches decode](https://github.com/sgl-project/sglang/pull/36988) (sgl-project/sglang) - [SGLang PR #38935: reject over-length requests at admission](https://github.com/sgl-project/sglang/pull/38935) (sgl-project/sglang) ## Write-ups & news - [In Other News: Anthropic Breach Dispute, UEFI Flaw Hits Most Servers, Cloudflare AI Data Leak](https://www.securityweek.com/in-other-news-anthropic-breach-dispute-uefi-flaw-hits-most-servers-cloudflare-ai-data-leak/) - [HN discussion: Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)](https://news.ycombinator.com/item?id=50252159) ## Caveats No CVE has been assigned. Cloudflare says the requests it found are consistent with ordinary long-context use, not repeated exploitation. The core fix (#36988) shipped in SGLang v0.5.20, but Cloudflare recommends v0.5.22 or later for the full set of related KV cache fixes. --- Machine-readable: https://pwn.watch/i/cloudflare-workers-ai-glm-5-3-sglang-kv-cache-cross-tenant-leak.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.