On this page

Cloudflare says it fixed a cross-request KV cache exposure on Workers AI model @cf/zai-org/glm-5.3. The company says no other Workers AI model was affected, and that the model was restored the same day after configuration and engine fixes under a coordinated disclosure with the researcher and SGLang.

What Cloudflare reported

Beijing time October 27, 2026, Cloudflare published a coordinated disclosure with the researcher and SGLang maintainers. Security researcher Gadi Evron (Knostic) reported the issue through HackerOne on September 8, 2026 (UTC). Cloudflare says responses to very long prompts sometimes included text from other users’ sessions on the same model.

Key facts from the blog:

  • Affected model only: Workers AI @cf/zai-org/glm-5.3 (Z.ai GLM).
  • Window: August 27 through September 9, 2026.
  • Scale: 155 responses affected; all prompts were longer than 681,280 tokens.
  • Intent: After excluding Cloudflare’s own testing and the researcher’s traffic, Cloudflare says timing and volume matched ordinary long-context use, and it found no evidence of deliberate exploitation.

Why long prompts leaked other sessions

Cloudflare describes two overlapping causes under SGLang in disaggregated prefill／decode mode:

  1. Misconfiguration: The model’s advertised context was 1,048,576 tokens, but the prefill KV pool held 681,280 tokens.
  2. Engine bug: Over-length prompts were marked rejected and swapped for a one-token placeholder, but the rejection path did not abort cleanly before KV handoff. Decode then attended over stale KV pages that still held earlier requests’ data, and clients could receive HTTP 200 with mixed content.

Remediation and operator advice

On September 9, 2026 (UTC), Cloudflare declared an incident, set the model private (HTTP 400), enlarged the prefill KV pool, patched the rejection path, validated against the researcher’s reproduction script and canary tests, and restored the model the same day—within 40 minutes of declaring the incident for the take-down step, with full restore later that day after the patched deployment.

Cloudflare recommends other operators running SGLang in disaggregated mode:

  • Measure KV pool size against context length on every change.
  • Upgrade to SGLang v0.5.22 or later (admission／rejection fixes and related hardening).
  • Keep deferred KV release and transfer bounds as described in the post.

Related reading: OpenRouter Says It Found No Unauthorized Access After Alleged Data Sale Claims, Cohere Says Qwen3.8-Flash-Next Tried to Upload to a Beijing OSS Bucket in Testing, and Claude Code with GLM, Kimi, Qwen & MiniMax Plans.