# Cloudflare Workers AI: GLM-5.3 answered 155 prompts with other tenants' data

> A KV cache pool smaller than its context window let Cloudflare's GLM-5.3 return other customers' prompts and answers.

- **Severity:** High: A working attack on a widely used AI product or ecosystem. A fix may exist. Patch or mitigate this week.
- **Category:** Incident, Vulnerability
- **Published by:** Cloudflare
- **Disclosed:** 2026-10-26
- **Affects:** Cloudflare Workers AI, SGLang, GLM-5.3
- **Research by:** Gadi Evron (Knostic), Michelle Chen
- **Primary source:** https://blog.cloudflare.com/kv-cache-exposure-remediation/
- **Page:** https://theinjection.dev/items/cloudflare-glm-5-3-kv-cache-cross-request-exposure/

Cloudflare's GLM-5.3 model on Workers AI returned data from other customers' requests in 155 responses between August 27 and September 9, after a KV cache pool smaller than the context window triggered an SGLang bug.

## What happened

Cloudflare disclosed on October 26 that its GLM-5.3 model on Workers AI returned content from other customers' requests in 155 responses. Gadi Evron of Knostic traced the anomaly through OpenRouter on September 7, 2026 and reported it through HackerOne the next day. Cloudflare published its post-incident report alongside Knostic's write-up and a coordinated fix in SGLang.

## How it works

Cloudflare launched GLM-5.3 with a context window of 1,048,576 tokens but a prefill KV cache pool that held only 681,280, so prompts above the pool size hit SGLang's rejection path, which replaces an over-length prompt with a single placeholder token. In disaggregated prefill and decode mode, SGLang's admission queues checked whether a request had finished rather than whether it had been rejected, so the rejected request was still admitted and transferred. The decode node reserved pages for the full prompt and then read stale KV cache pages left by earlier requests, returning HTTP 200 instead of an error. A developer using the name kevin-14 had reported the same engine bug as SGLang issue 30233 on July 6, 2026.

## Who is affected

GLM-5.3 on Cloudflare Workers AI was the only affected hosted model, and Cloudflare states that no other Workers AI model was involved. Self-hosted SGLang operators are exposed when they run disaggregated prefill and decode with a KV cache pool smaller than the configured context length. Cloudflare says a single-node deployment handled the same case correctly.

## What to do

Operators running SGLang in disaggregated mode should upgrade to v0.5.22 or later, or backport pull requests 36988 and 38935. Compare each prefill and decode node's KV pool size from its startup log against the context length after any change to weights, quantization, parallelism or memory settings, and lower the context length when the pool is smaller. Cloudflare customers need take no action, because the platform fix shipped on September 9.

## Quick facts

- **Affected:** GLM-5.3 on Cloudflare Workers AI (@cf/zai-org/glm-5.3)
- **Exposure window:** August 27 to September 9, 2026
- **Responses affected:** 155, all answering prompts over 681,280 tokens
- **Found by:** Gadi Evron of Knostic, reported via HackerOne on September 8, 2026
- **Fixed in:** SGLang v0.5.20 and v0.5.21; Cloudflare recommends v0.5.22 or later
- **CVE:** None assigned
- **Status:** Fixed on Workers AI on September 9, disclosed October 26

## Questions

### Was my Cloudflare Workers AI data exposed in the GLM-5.3 leak?

Cloudflare says 155 responses between August 27 and September 9, 2026 contained data from other customers' requests, and all of them answered prompts longer than 681,280 tokens. Accounts that never sent prompts of that length to GLM-5.3 were not affected. Cloudflare also states that no other model hosted on Workers AI was involved in the exposure.

### Do I need to act if I self-host SGLang?

Self-hosted SGLang deployments are exposed when they run disaggregated prefill and decode with a KV cache pool smaller than the configured context length. Cloudflare reports that a single-node deployment handled the same over-length request correctly. Operators should compare the KV pool size in each prefill and decode node's startup log against the context length, and lower the context length when the pool is smaller.

### Which SGLang version fixes the cross-request KV cache bug?

SGLang pull request 36988, which retires aborted prefill requests before their results reach decode, shipped in v0.5.20, and pull request 38935, which rejects over-length requests at admission, shipped in v0.5.21. Cloudflare recommends v0.5.22 or later for all operators, or backporting both patches. Cloudflare also advises enabling corruption detection with the KV checksum and canary flags where the model architecture supports them.

### Was the GLM-5.3 exposure exploited deliberately?

Cloudflare says that after excluding its own testing and the researcher's, the affected requests matched ordinary long-context use in timing and volume, and it found no evidence of deliberate exploitation. Knostic notes that triggering the leak needed only an ordinary paid account and an API token, with no victim credentials or user interaction, and that affected requests were still billed in full.

## Sources

1. [Cloudflare Report](https://blog.cloudflare.com/kv-cache-exposure-remediation/)
2. [Knostic Write-Up](https://www.knostic.ai/blog/hallucination-or-cross-tenant-when-an-llm-answers-with-another-users-context)
3. [SGLang Issue 30233](https://github.com/sgl-project/sglang/issues/30233)