Cloudflare discloses cross-request KV cache leak on Workers AI GLM-5.3 (Aug 27–Sep 9); 155 long-context replies affected; SGLang v0.5.22+ fixes

Why it matters

【Key points】

Cloudflare at 22:01 UTC 2026-10-26, with LMSYS/SGLang, disclosed a cross-request KV cache leak on Workers AI `@cf/zai-org/glm-5.3` only (2026-08-27–09-09). Prompts >~681,280 tokens could return another tenant's recent same-model session; 155 responses affected; no deliberate exploitation found. Cause: prefill KV pool ~681k vs advertised 1,048,576 context, plus a PD-disaggregated SGLang placeholder-reject path that still handed work to decode over stale pages. HackerOne Sep 8 → model private within ~40 minutes Sep 9 → pool enlarge + engine patch, restore same day; upstream #36988/#38935 in SGLang v0.5.20–v0.5.22; operators urged to run v0.5.22+, measure pool vs context, deferred release.

【Verifiable】

https://blog.cloudflare.com/kv-cache-exposure-remediation/

https://www.lmsys.org/blog/2026-10-26-cf-security

https://github.com/sgl-project/sglang/pull/36988 https://github.com/sgl-project/sglang/pull/38935

Researcher: Gadi Evron / Knostic via Cloudflare HackerOne

【Our read】

1. Background: multi-tenant hosted-inference isolation failure — not weight poisoning or prompt injection. CF made pool < context plus PD reject-path semantics checkable. Pair with e/1053 OpenAI training containment and e/967 Clairic: serving-memory ownership.

2. Peer compare: vLLM / DeepInfer / llm-d stacks that reuse KV pages and optionally disaggregate PD share the same config debt when pool is residual-VRAM-derived and context is separate. SGLang early reject + deferred release defaults are an industry patch. GLM-5.3 was the trigger; the bug is in serving, not GLM weights.

3. Impact: buyers sending ≥~680k-token prompts to multi-tenant hosts should put cross-tenant KV leakage on vendor questionnaires/SLAs; self-hosted PD fleets should run the CF/SGLang checklist. Model restored 9/9; ~7-week lag is coordinated disclosure, not a newly unfixed live hole.

4. Limits: 155 / no exploitation / GLM-5.3-only are vendor findings. Do not generalize to all Workers AI.