Cloudflare says a KV cache flaw leaked other customers' data in 155 GLM-5.3 responses

Cloudflare has published a post-incident report explaining how its hosted GLM-5.3 model on Workers AI returned data belonging to other customers. According to the report, released on 26 October 2026 as a coordinated disclosure with the SGLang maintainers and the researcher who found the problem, 155 responses produced between 27 August and 9 September contained fragments of other users' requests. Cloudflare says GLM-5.3 was the only Workers AI model affected.

Two problems that combined

The first issue was a configuration mismatch. The model was advertised with a context window of 1,048,576 tokens, but the pool of key-value (KV) cache memory used during the prefill stage held only 681,280 tokens. Every affected response came from a prompt longer than that pool.

The second was a bug in SGLang, the open-source inference engine, when prefill and decode run on separate machines. A request that should have been rejected for being too large kept running, and the decode stage read cache pages still holding data from earlier requests. The client received a normal success code rather than an error. The underlying SGLang issue had been filed upstream in July 2026.

Detection and fix

Gadi Evron of security firm Knostic reported the behaviour through Cloudflare's HackerOne bug bounty programme on 8 September. Cloudflare declared an incident the next day, made the model private, deployed a corrected configuration and restored public access the same day after validating the fix against the researcher's reproduction script. The prefill pool now holds about 2.04 million tokens, and a patched engine returns an error for rejected requests instead of processing them. Cloudflare also lists further hardening work and plans a formal verification effort for KV cache transfer. Upstream, SGLang fixes shipped in versions 0.5.20 and 0.5.21; Cloudflare recommends 0.5.22 or later.

Open questions

Cloudflare says its traffic analysis found no evidence of deliberate exploitation. It adds that the affected requests look consistent with ordinary long-context use. The figure of 155 counts responses, not distinct customers, and the report does not say how affected customers were contacted beyond a status-page update when the model was disabled, or how sensitive the exposed data was. The incident also matters beyond Cloudflare: other operators running similar disaggregated SGLang setups with undersized cache pools on older versions may have faced the same risk, which the report does not assess.