Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)
Cloudflare was alerted on September 8, 2026, by Gadi Evron to a tenant isolation issue in the GLM-5.3 Workers AI model, active since August 27, 2026. The issue, which caused cross-request KV cache exposure, was remediated, and the model was restored on September 9. This bug, reported to SGLang as issue #30233 on July 6, 2026, led to patches in SGLang v0.5.20, v0.5.21, and v0.5.22, with Cloudflare recommending updates to v0.5.22 or later.
This report details the specific vulnerability in GLM-5.3, unlike general security advisories, and traces its fix through SGLang versions up to v0.5.22.
Time & source
Times shown in UTC
Display time zone: UTC
Local time zone unavailable; showing UTC.
IngestedOffset at this time: UTC+0Oct 26, 2026, 23:00 UTC
- Ingested
- Oct 26, 2026, 23:00
- Source type
- Unclassified
Discussion trend
The percentage is based on collected discussion signal, not new comments or independent people. The curve only compares the same topic across time.
- Basis
- Running about 2.1× the median of this source's recent listed items
- Metric comparison
- 129 vs median 62 (20 baseline samples)
- Detected
- 10/27, 09:00
Full text isn't available here.
Read at source →