Cloudflare Patches KV Cache Bug That Exposed Customer Data

Cloudflare’s GLM-5.3 Workers AI model contained a KV cache isolation flaw that exposed customer data across request boundaries. Between August 27 and September 9, 2026, the vulnerability affected 155 responses generated by prompts longer than 681,280 tokens. A security researcher reported the issue on September 8; Cloudflare reproduced it on September 9 and deployed fixes to restore service that day.

The flaw resulted from two overlapping issues. First, GLM 5.3 was deployed with a 1,048,576-token context window, yet the prefill GPU KV cache pool could only hold 681,280 tokens—a mismatch Cloudflare knew about before launch. When a prompt exceeded pool capacity, SGLang rejected it internally and substituted a one-token placeholder, which the prefill stage then processed into a KV cache and transferred to the decode stage. The decode stage interpreted the transfer complete signal as confirmation that all cache had been overwritten, but the previous request’s data actually remained in unused pool pages. Consequently, responses were generated while reading from stale cache containing other users’ data.

Cloudflare expanded the prefill GPU KV cache pool to approximately 2.04 million tokens, sufficient to accommodate the full context window. It also patched SGLang’s inference engine to retire requests with pending rejections before they reach the decode stage. Additionally, Cloudflare changed its validation process to directly verify pool capacity against the configured context length before deploying disaggregated configurations, rather than relying on HTTP response codes. SGLang maintainers merged related upstream fixes, including verification that transferred token counts match reserved capacity.