Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang
Cloudflare corrected a tenant isolation flaw in its GLM-5.3 Workers AI model that briefly exposed data from other users' sessions in responses to long prompts between August 27 and September 9, 2026.
On September 8, 2026, Cloudflare was notified by security researcher Gadi Evron of Knostic about a tenant isolation issue in the GLM-5.3 Workers AI model, which had been active since August 27. The company took the model offline within 40 minutes of confirming the issue and restored service the next day after deploying a corrected configuration and patched inference engine. During the incident, 155 responses to prompts exceeding 681,280 tokens contained data from other customers' prior requests to the same model, though no evidence of deliberate exploitation was found.
The vulnerability stemmed from a misconfigured open-source inference engine, SGLang, which used a KV cache pool of 681,280 tokens despite the model's advertised 1,048,576-token context window. A second bug in SGLang's handling of over-length requests in disaggregated mode caused the decode node to generate responses using stale cache pages containing data from earlier sessions. Cloudflare fixed the issue by increasing the KV cache pool to approximately 2.04 million tokens and patching the engine to safely reject requests that exceed the pool size before any processing begins.
Workers AI runs GLM-5.3 with SGLang in a disaggregated configuration, where prefill GPUs generate a KV cache that is transferred via RDMA to decode GPUs for response generation. The KV cache pool is a shared fixed-size memory space where pages are reused without zeroing between requests, requiring precise ownership tracking. Cloudflare acknowledged that its pre-launch testing failed to validate model output coherence for long contexts, relying instead on HTTP status codes and performance metrics, which masked the configuration mismatch.
Cloudflare has coordinated disclosure with SGLang's upstream maintainers, proposing fixes that were merged upstream, including changes to verify token transfers and reject requests earlier in the pipeline. The company now directly checks KV pool size against context length before deploying disaggregated model updates, replacing reliance on response codes or performance benchmarks as indicators of correct configuration.