Cloudflare fixes GLM-5.3 flaw that exposed customer data

Cloudflare has disclosed a cross-request KV cache exposure in the GLM-5.3 Workers AI model (@cf/zai-org/glm-5.3), reported by security researcher Gadi Evron of Knostic. The issue, which began affecting users on 27 August 2026, manifested as responses containing data from other customers’ sessions for prompts longer than 681,280 tokens. In total, 155 responses were impacted before the model was taken offline, a corrected configuration deployed, and the service restored on 9 September 2026.

Cloudflare notes that, after excluding its own tests and the researcher’s data, the observed requests aligned with normal long-context usage rather than deliberate exploitation, and there was no evidence of wide-scale abuse beyond the two overlapping problems described below. The company emphasised that no other Workers AI models were affected.

The root cause combined a misconfiguration of the open-source inference engine, SGLang, with a bug in how disaggregated prefill/decode mode managed over-length requests. The prefill pool on GLM 5.3 was 681,280 tokens while the model’s context length was 1,048,576 tokens, creating a vulnerability when prompts exceeded the pool. A placeholder approach, intended to terminate over-length requests, instead allowed KV cache data to be transferred and used by the decode node, exposing data from prior requests.

Immediate remediation included expanding the prefill KV pool to about 2.04 million tokens and hardening the rejection path in the engine, with upstream fixes merged in SGLang v0.5.22 and later. Cloudflare also published a coordinated disclosure with SGLang maintainers and outlined ongoing hardening and measurement practices to prevent recurrence, while noting that GLM 5.3 was the only model affected.