🔍 Read the full analysis: Cloudflare’s KV Cache Leak And The Risk Of AI Session Mix-Ups on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the leak to a mismatch in its KV-cache capacity and a bug in the SGLang inference engine; it says it found no evidence of deliberate exploitation. The report does not explain how affected customers were notified.
Cloudflare says a flaw in its hosted GLM-5.3 model service caused 155 responses to include text from other customers’ requests between August 27 and September 9, 2026. In an incident report published October 26, the company attributed the leak to a mismatch in its KV-cache configuration combined with a bug in the open-source SGLang inference engine; it said it found no evidence that anyone deliberately exploited the issue.
The affected endpoint was @cf/zai-org/glm-5.3 on Cloudflare Workers AI. Cloudflare said every affected request had a prompt longer than 681,280 tokens. It counted 155 responses containing other customers’ request data during the 14-day incident period, after excluding its own testing and the researcher’s report. The company said the remaining requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw.
Cloudflare’s report describes two failures. Its prefill GPUs had KV-cache capacity for 681,280 tokens, despite the service advertising a context window of 1,048,576 tokens. Cloudflare expected oversized prompts to return errors. Separately, SGLang marked prompts that did not fit as rejected, but queues in Cloudflare’s split prefill-and-decode setup checked whether a request was finished rather than whether it had been rejected. The decode stage could then read cache pages that still contained other requests’ data.
The company said a researcher reported the issue through its HackerOne program on September 8. Cloudflare’s timeline says it declared an incident at 13:22 UTC the following day and took the model offline 38 minutes later. It restored a fixed version that evening. The report says cache pages are not cleared between requests because they are expected to be overwritten, a practice Cloudflare described as common and needed for performance. In this case, the faulty request handling meant some pages were not overwritten before being read.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
How Cache Pages Crossed Requests
The incident shows how a failure in infrastructure around a model can expose data even when the model itself is not the source of the defect. Shared GPU memory is used to store intermediate information generated while processing prompts; the service’s request tracking is supposed to keep each customer’s data separate. Cloudflare’s account says a capacity mismatch and a rejection-handling bug broke that separation for some exceptionally long prompts.
For customers, the confirmed impact is that some responses included text from other users’ requests. The report does not establish that every leaked fragment was sensitive, nor does it identify the customers or describe the contents. Still, the event matters to organizations sending code, documents, or other private material to hosted AI services: confidentiality depends not only on model behavior, but also on memory management, request routing, and testing of failure paths.
The episode also illustrates a gap in Cloudflare’s pre-launch checks. The company said it tested HTTP response codes and engine performance at long context lengths without checking the model output and its coherence. A response returning HTTP 200 was not proof that the underlying request had been handled safely. That distinction is relevant to users evaluating service assurances and to providers testing systems under boundary conditions.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
The Long-Context Failure Path
A KV cache stores intermediate values produced as a model processes a prompt, allowing it to generate later tokens without recomputing all earlier work. The cache can be large for very long prompts, so inference systems divide GPU memory into pages that requests use and then return. Cloudflare says those pages are not zeroed after each request; the next request is expected to overwrite them.
Cloudflare ran the affected model in a disaggregated arrangement: one GPU pool processed prompts and built the cache, while another generated responses. According to its report, when a prompt exceeded the available prefill capacity, SGLang replaced it with a one-token placeholder after marking it rejected. In the split setup, the request passed through queues that did not check that rejection status. Decode had reserved pages for the original prompt, but prefill wrote only one; the remaining pages could retain other users’ prompts or partial generations.
The report says the mismatch was known before launch, but Cloudflare expected the inference engine to reject prompts that exceeded capacity. It also says an SGLang issue describing the bug had been filed on July 6, 2026, and Cloudflare noticed it during its own investigation. These details are Cloudflare’s account of the incident and its review.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notices and Data Scope
Cloudflare’s published account does not say how affected customers were notified, whether every affected customer has been contacted, or what the exposed text contained. It reports 155 affected responses but does not provide a customer count or describe the sensitivity of the data in those responses. The report also does not establish whether recipients noticed that a reply contained material from another request.
The company said it found no evidence of deliberate exploitation, but that is an account of its investigation, not proof that no one attempted to trigger the flaw. The supplied report does not detail what logs or other evidence were available to support that conclusion. It is also not clear whether any customers experienced further effects beyond receiving responses that included other users’ text.
Follow-Up From Cloudflare
Cloudflare says it restored a fixed version of the model on the evening of September 9 after taking the service offline. Its report describes the incident response and the technical causes, but the available account does not set out a public timetable for further disclosure or describe additional safeguards being rolled out beyond the fix.
The outstanding questions are whether Cloudflare will publish more detail about customer notification and the information involved, and what changes it will make to testing long-context requests and handling rejected jobs. For customers, those details would help clarify the practical scope of the incident and how the provider is addressing the conditions that allowed stale cache pages to be read.
Key Questions
What happened in Cloudflare’s KV-cache incident?
Cloudflare says 155 responses from its hosted GLM-5.3 service included text from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a KV-cache capacity mismatch and a bug in SGLang’s handling of rejected requests.
Which Cloudflare service was affected?
The affected endpoint was @cf/zai-org/glm-5.3 on Workers AI. Cloudflare says all affected prompts were longer than 681,280 tokens.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said the timing and volume of the requests were consistent with ordinary long-context use and that it found no evidence of deliberate exploitation. That is the company’s finding; its report does not provide a full account of the evidence reviewed.
Did Cloudflare say how customers were notified?
The incident report described in the source material does not explain how affected customers were told or identify the number of customers involved. The contents and sensitivity of the exposed text are also not specified.
Source: ThorstenMeyerAI.com
