Cloudflare says KV cache bug leaked other customers' data in 155 GLM-5.3 responses

Cloudflare disclosed on October 26, 2026 that between August 27 and September 9, 2026, 155 responses from the GLM-5.3 model on Workers AI contained data from other customers' requests. The model was deployed with a 1,048,576 token context window, but the KV cache pool on its prefill GPUs held only 681,280 tokens, and every affected prompt was longer than that pool size. A bug in the SGLang inference engine, in disaggregated prefill and decode mode, swapped over length prompts for a one token placeholder while leaving earlier cache state intact, so the decode side generated answers reading stale pages from prior requests and returned a normal looking HTTP 200 response. No other Workers AI model was affected, and Cloudflare says it found no evidence of deliberate exploitation.

Knostic's Gadi Evron reported the issue through HackerOne on September 8, 2026. Cloudflare reproduced the leak within 25 minutes the next day, took the model private, and restored it the same day with the prefill pool expanded to about 2.04 million tokens and a patched rejection path. The upstream fix shipped in SGLang v0.5.22, and Cloudflare recommends that anyone self hosting SGLang in disaggregated mode run v0.5.22 or later and check that their KV pool size is not smaller than the context length they advertise.

Sources: Cloudflare; Tensorust