Cross‑tenant KV Cache Exposure in Cloudflare Workers AI GLM‑5.3 Model Leads to 155 Mixed Responses
What Happened — On August 27 2026 Cloudflare’s Workers AI platform began serving the GLM‑5.3 model with a 1 048 576‑token context window while the underlying SGLang inference engine’s KV‑cache pool could only hold 681 280 tokens. When a request exceeded the cache capacity, a bug in SGLang’s prefill/decode handling caused the KV cache from a prior request to be transferred to the next request instead of aborting with an error. Between August 27 and September 9, 155 customer prompts longer than 681 280 tokens received responses that contained fragments of other customers’ data. Cloudflare was alerted on September 8 by a researcher, took the model offline within 40 minutes, applied a corrected configuration and a patched SGLang version, and restored service on September 9. No evidence of deliberate exploitation was found, and no other Workers AI models were impacted.
Why It Matters for Trust & Control Assurance — The incident highlights the importance of robust tenant‑isolation controls and continuous configuration monitoring to provide defensible evidence of data segregation.
Who Is Affected — SaaS providers and cloud‑hosted AI services that expose multi‑tenant inference endpoints.
Recommended Actions —
- Review KV‑cache and context‑window configurations for all multi‑tenant inference workloads.
- Deploy automated monitoring that alerts when request sizes approach resource limits.
- Capture and retain evidence of isolation controls for audit readiness.
Technical Notes —
- Attack vector: misconfiguration combined with a bug in the open‑source SGLang inference engine.
- No CVE assigned; the flaw resides in SGLang’s handling of over‑length prompts.
- Data exposed: fragments of other customers’ generated text (≤ 155 responses).