Cloudflare Addresses Cross-Request KV Cache Exposure in GLM-5.3 Workers AI Model
According to Cloudflare. Cloudflare details a tenant isolation issue affecting the GLM-5.3 Workers AI model and its coordinated remediation with SGLang.
- • A tenant isolation issue affected the GLM-5.3 Workers AI model starting on August 27, 2026.
- • Cloudflare remediated the issue and restored the model on September 9, 2026.
- • A total of 155 responses were affected, limited to prompts longer than 681,280 tokens.
- • The vulnerability stemmed from a configuration mismatch combined with an SGLang inference engine bug.
Incident Overview
On September 8, 2026, Cloudflare was alerted by security researcher Gadi Evron to a tenant isolation issue affecting the GLM-5.3 Workers AI model. Cloudflare remediated the issue and restored the model on September 9, confirming that no other models hosted on Workers AI were affected. Between August 27 and September 9, a small number of customers received responses containing data from other customer requests made shortly before theirs.
Root Causes
This specific report of cross-request KV cache exposure resulted from two overlapping issues. The first was a misconfiguration of the open-source inference engine SGLang, where the KV cache pool on prefill GPUs was smaller than the model context window. The second was a bug in how SGLang handled resulting over-length requests in disaggregated prefill and decode mode, leading the decode node to generate responses while attending over stale cache pages.
Remediation Actions
After disabling the model, Cloudflare adjusted the pool configuration to hold the full context and patched the inference engine so that pending rejections are retired at the admission queue before any KV transfer occurs. Both changes were validated against the researcher's reproduction script and canary-marker tests before public access was restored.
- 1. blog.cloudflare.comOpen source