A Cloudflare KV cache flaw was publicly disclosed on October 26, 2026: Cloudflare and the team behind the open-source inference engine SGLang published a joint account confirming a cross-request cache isolation failure that mixed other users' request content into some replies. This was not an external intrusion. It was an isolation failure caused by a configuration mistake combined with an engine bug. The affected model has been fixed, and SGLang has released patched versions.
The immediate trigger was a mismatch between two numbers. When Cloudflare deployed Zhipu's GLM 5.3 on Workers AI, the model's advertised context window was 1,048,576 tokens, but the KV cache pool on the prefill nodes could hold only 681,280 tokens. An over-long prompt that exceeded the pool should have been rejected with an error, and SGLang did mark it as rejected internally, replacing the original prompt with a one-token placeholder. In a disaggregated prefill and decode deployment, however, the admission queues only checked whether a request was "finished", not whether it had been "rejected", so the rejected request entered processing as usual.
The decode node read leftover data from earlier requests
The prefill node generated KV cache for only the placeholder token and then signalled "transfer complete", while the decode node had reserved a full set of cache pages for the original prompt length. Only the first page had been written by the current request; the remaining pages still held leftover content from earlier requests. The decode node kept generating over those pages, and the reply that came back looked coherent and carried a 200 status code, yet it contained data from other users' sessions. Cloudflare notes that cache pages are not zeroed between requests in the first place; the engine is supposed to track exactly who owns each page, and that tracking broke on the rejection path.
Only GLM 5.3 was affected; operators should check the cache pool first
According to Cloudflare, 155 replies were affected between August 27 and September 9, 2026, all for prompts longer than 681,280 tokens. Security researcher Gadi Evron submitted a report through HackerOne on September 8. Cloudflare reproduced the issue the next day and took the model offline within 40 minutes of declaring a security incident, then restored service the same day after a configuration fix and an engine patch. It found no evidence that anyone deliberately exploited the flaw. Cloudflare has expanded the prefill cache pool to about 2.04 million tokens and recommends that all operators using SGLang upgrade to v0.5.22 or later, and check the running engine's cache pool size against the model's context length before deployment, rather than relying on a 200 response from the API.
