Cloudflare says GLM-5.3 bug on Workers AI leaked customer data into 155 responses
A public SGLang bug report preceded the exposure. Cloudflare also knew before launch that its cache capacity fell short of the model’s configured context window.
By BenchdictPublished Oct 27, 20263 min read
Cloudflare disclosed on October 26 that GLM-5.3, an AI model on its Workers AI hosted-inference service, leaked other customers’ data into 155 responses. The exposure ran from August 27 to September 9.
This matters to GLM-5.3 customers who sent long prompts during that window and operators using SGLang model-serving software with split prompt processing and generation. The failure was preventable: Cloudflare knew its capacity mismatch before launch, and the underlying bug was public from July 6. An affected-customer count and confirmation of individual notification would change our assessment of its response.
Key facts
- Exposure window
- August 27 to September 9, 2026
- Affected responses
- 155, according to Cloudflare
- Original cache capacity
- 681,280 tokens
- Configured context window
- 1,048,576 tokens
- Recommended SGLang minimum
- v0.5.22
Where the exposure occurred
Cloudflare says every identified affected response followed a prompt exceeding 681,280 tokens. The exposed material included other customers’ recent prompts and partial generations from the same model; no other Workers AI model was affected. Cloudflare says it found no evidence of deliberate exploitation, a finding it notes is not a guarantee.
Cloudflare counts affected responses, not customers, and its account does not say whether affected customers were notified individually.
According to Cloudflare, researcher Gadi Evron reported the issue through HackerOne, its vulnerability-reporting program, on September 8. On September 9, the company made the model private at 14:00 UTC. All prompt-processing nodes had the corrected configuration by 14:52 UTC, and public access resumed at 19:40 UTC.
How a rejected request reached generation
SGLang’s account describes the failure in deployments that separate prefill from decode across nodes. Prefill processes the prompt; decode generates the response. The key-value, or KV, cache stores intermediate model data passed between those stages.
According to Cloudflare, GLM-5.3 had a configured context window—the longest prompt the model is set up to accept—of 1,048,576 tokens, but only 681,280 tokens of prefill cache capacity. Prefill rejected prompts above that capacity even when they fit within the advertised window. The company knew about the mismatch before launch; its long-context tests checked response status and performance without validating output coherence.
SGLang explains that a rejected prefill request could still enter the handoff to generation. Decode could then read cache pages that had not been populated for that request. Cloudflare attributes the exposure to reused pages retaining other users’ data.
In SGLang’s single-node rejection path, the request instead returned an error. Cloudflare says affected clients received HTTP 200, indicating success, rather than the expected HTTP 400 rejection.
Capacity and rejection handling changed separately
Cloudflare increased the prefill pool to about 2.04 million tokens so valid context-window requests would fit. It also patched the engine to end rejected requests with their original error before handoff setup, allocation or cache transfer. Both changes passed the researcher’s reproduction script and the company’s marker-based tests before access resumed.
The company now checks the running engine’s cache capacity against context length before changes ship to deployments that split prefill and decode. Its account says engine fixes and hardening were applied to every model it serves with SGLang.
According to Cloudflare, SGLang issue #30233 was filed on July 6, before the August 27 exposure began. Fix #36988 was already merged by September 6, before Evron’s September 8 report, but remained unreleased. SGLang identifies #36988 as the fix that ends rejected requests after the final prefill result, and #38935 as an earlier admission check.
Which SGLang versions carry the fix
Cloudflare identifies v0.5.20 as an initial patch release and also associates addressing the bug with v0.5.21, released October 2. Its recommended operator action is to upgrade to v0.5.22 or later.
Sources
- Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLangPrimaryCloudflare Blog, Oct 26, 2026.What we took from it: Incident scope, exposed material, exploitation finding, response count, timeline, known capacity mismatch, testing limitations, remediation, release wording and upgrade guidance.
- SGLang security update: improving request isolationIndependentlmsys.org, Oct 27, 2026.What we took from it: Split prefill/decode mechanism, single-node rejection comparison and the distinct purposes of changes #36988 and #38935.
- [Bug] PD disaggregation: aborted prefill requests (input too long) cause decode to generate garbage from incomplete KV cache · Issue #30233 · sgl-project/sglangDocsGitHub, Jul 6, 2026.What we took from it: Earlier public documentation of rejected prefill requests reaching generation with incomplete cache data.
Benchdict, Edited and published by Jason, Editor & Publisher. Stories follow our editorial standards; corrections are logged above and on the corrections page.