Cloudflare fixes cross-tenant KV-cache exposure in GLM‑5.3
Cloudflare says the GLM‑5.3 deployment on Workers AI could read KV-cache pages belonging to other customers on very long prompts, affecting 155 responses.
AT A GLANCE
Key points
- The issue was triggered only by GLM‑5.3 prompts longer than 681,280 tokens.
- Cloudflare confirmed that 155 responses contained cross-tenant data.
- The model was patched and restored on September 9; SGLang 0.5.22 or newer is recommended.
What is changing?
Cloudflare detailed a tenant-isolation issue affecting `@cf/zai-org/glm-5.3` on Workers AI on October 26. Between August 27 and September 9, some prompts longer than 681,280 tokens followed a path that should have rejected them but instead reached decode, where they could read KV-cache pages left by previous customers. The company says 155 responses were affected, no other hosted model shared the issue, and it found no evidence of deliberate exploitation.
Cloudflare temporarily disabled the model on September 9. It enlarged the KV pool beyond the context window and deployed SGLang patches that retire rejected requests before transfer, then restored the model the same day. The hardening was applied across its SGLang deployments. Cloudflare recommends that other operators using disaggregated inference move to SGLang 0.5.22 or newer and validate KV-pool sizing, transfer integrity, and cancellation paths together.
Explore the original sources
Source date: 26 October 2026.
Published by AI Radar: 27 Oct 2026, 03:06 (Istanbul, UTC+3).
FOLLOW THE TOPIC
Topics and tags
Share your discovery.
Send this story to a friend.
Reader comments
What do you think about this development? Share your experience or question. Comments are published after editorial approval.
Your name/nickname and comment become public if approved. Read: Privacy notice.
Loading comments…