🔍 Read the full analysis: Cloudflare’s KV Cache Leak: AI Answers, Session Privacy, And Spam on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare says a configuration mismatch and an SGLang inference-engine bug caused 155 responses from its hosted GLM-5.3 model to contain text from other customers’ requests. The company says the issue affected prompts longer than 681,280 tokens, took the model offline after confirming an incident, and found no evidence of deliberate exploitation. A separate AI-generated vulnerability-report surge highlights growing pressure on security triage teams.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The company attributed the exposure to a mismatch in its long-context configuration combined with a bug in the open-source SGLang inference engine, and said the issue could be triggered only by prompts longer than 681,280 tokens.
Cloudflare’s incident report, published October 26, says security researcher Gadi Evron of Knostic reported the issue through the company’s HackerOne program on September 8. Evron said very long prompts sent to the @cf/zai-org/glm-5.3 endpoint sometimes returned text belonging to other users’ sessions. Cloudflare investigated and counted 155 affected responses over 14 days, excluding its own tests and the researcher’s activity.
The company identified two faults. Its prefill GPUs had a KV-cache pool sized for 681,280 tokens, despite the endpoint advertising a context window of 1,048,576 tokens. SGLang then mishandled requests that exceeded the available pool: in Cloudflare’s split prefill-and-decode setup, queues checked whether a request had finished but not whether it had been rejected. As a result, the decode stage could read cache pages that had not been overwritten for that request.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It said the affected requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw. The company also said it found no evidence of deliberate exploitation.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in inference infrastructure can expose data even when the underlying AI model is not itself compromised. KV caches hold intermediate information used to generate responses. If the system’s allocation and request-handling controls fail, data left in reused GPU memory may become available to another request.
For customers, the reported risk is not limited to an inaccurate answer: a model response could include text from another customer’s prompt or partial output. That can matter for confidential code, business documents, or other sensitive material sent to a hosted service. Cloudflare’s report gives a specific affected-response count, but does not establish what information those responses contained or whether individual customers recognized the exposure.
The report also points to a testing gap. Cloudflare said its long-context checks examined HTTP status codes and engine performance without validating the output’s content and coherence. A successful response code, in other words, did not show that the answer contained only the requesting customer’s data.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the KV Cache Failure Occurred
A language model uses a KV cache to retain intermediate calculations from a prompt so it can generate later words without processing the entire input again. Cloudflare said cache pages are not zeroed between requests; instead, the next request is expected to overwrite them. This approach, the company described, is used to improve performance, making correct memory allocation and request handling central to keeping sessions separate.
Cloudflare runs the model in a disaggregated setup: one GPU pool processes the prompt and builds the cache, while another produces the response. According to the report, an oversized prompt was marked as rejected and replaced with a one-token placeholder. The prefill stage wrote only that placeholder, while the decode stage had reserved space for the original prompt and read additional pages that still contained other requests’ prompts or partial generations. The client received an HTTP 200 response rather than an error.
Cloudflare said the SGLang flaw had previously been reported as issue #30233 on July 6, 2026, but the company noticed it only during its investigation. The separate account of an AI-generated report surge comes from a Firedancer audit contest described by ThorstenMeyerAI.com: Jump Crypto received 809 submissions from 162 researchers, which it reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all of them. The contest and Cloudflare incident are distinct developments, but together they illustrate challenges in reviewing both AI infrastructure and AI-assisted security work.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
What the Report Does Not Resolve
Cloudflare’s report does not say how affected customers were notified, what specific data appeared in the 155 responses, or whether recipients reported seeing another customer’s text. It also does not identify the customers involved or detail the full scope of any exposed information. The reported count is a count of affected responses, not a count of customers or separate data records.
The company said it found no evidence of deliberate exploitation and described the request pattern as consistent with ordinary use. Those are Cloudflare’s investigation findings; the published information does not independently establish who received each response or whether any exposed text was retained or used elsewhere. The report also does not provide details about the fixed version’s testing or whether similar configurations were reviewed across other hosted models.
Customer Notice and Fix Verification
The immediate next questions are whether Cloudflare has notified every affected customer and what further checks it has made on related model deployments. The incident report says a fixed version was restored the evening the issue was addressed, but the source material does not give a schedule for additional public updates or describe any broader audit of cache handling.
Cloudflare’s account also leaves open whether it will change long-context testing to include checks of response content, not just service status and performance. For customers using hosted models, the incident underscores the value of following provider notices and asking what data was affected, how notification was handled, and what safeguards were changed. Those details have not been provided in the report described here.
Key Questions
What did Cloudflare disclose?
Cloudflare said 155 GLM-5.3 responses included data from other customers’ requests during the August 27–September 9, 2026 incident period.
What caused the exposure?
The company attributed it to a KV-cache capacity mismatch and an SGLang bug that allowed rejected, oversized requests to proceed through a split inference setup.
Could every GLM-5.3 prompt trigger the issue?
No. Cloudflare said the problem could be triggered only by prompts longer than 681,280 tokens.
Did Cloudflare report evidence of an attacker exploiting the bug?
Cloudflare said it found no evidence of deliberate exploitation and that request timing and volume appeared consistent with ordinary long-context use. That is the company’s assessment of its investigation.
What is still unknown about the affected customers?
The report described in the source material does not say how customers were notified, what specific data appeared in the responses, or how many individual customers were affected.
Source: ThorstenMeyerAI.com
