Cloudflare GLM-5.3 Cache Isolation Failure Leaked Customer Data in 155 Responses

Cloudflare disclosed a cross-customer data leak in the GLM-5.3 model hosted on Workers AI, with 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. An undersized prefill key-value (KV) cache pool, combined with a rejection-handling bug in the SGLang inference engine, allowed response-generation nodes to read stale GPU cache pages belonging to other requests. Requests exceeding 681,280 tokens could trigger the failure without producing an error. Cloudflare reported no evidence of deliberate exploitation and said no other Workers AI models were affected.

Gadi Evron of Knostic reported the issue through HackerOne on September 8. Cloudflare disabled public access to the model on September 9 and restored service that evening after increasing cache capacity and patching the inference engine. Cloudflare and SGLang subsequently added broader cache-lifecycle protections and are working on stronger memory isolation. Operators running similarly configured, disaggregated SGLang deployments should upgrade to version 0.5.22 or later and review cache-capacity settings and cross-request isolation controls.