A flaw in Cloudflare's Workers AI platform caused 155 responses from the GLM 5.3 model to include data from other customers' requests, the company said in a postmortem published Monday. All of the affected responses followed prompts longer than 681,280 tokens, and they were generated between August 27 and September 9, 2026.

Security researcher Gadi Evron of Knostic reported the problem to Cloudflare on September 8 through the company's HackerOne bug bounty program. Cloudflare reproduced the issue the next morning, declared a security incident and took the model offline within 40 minutes. The company restored the model on September 9 after deploying a corrected configuration and a patched inference engine.

Did the flaw affect other Workers AI models?

Cloudflare said it confirmed that no other model hosted on Workers AI was affected. After excluding its own tests and the researcher's, the company said the requests it reviewed matched the timing and volume of ordinary long-context use. It found no sign that anyone had repeatedly exploited the bug.

Two problems overlapped

What caused the Cloudflare GLM 5.3 data exposure?

Cloudflare said the exposure came from two issues that combined to produce the leak. The first was a misconfiguration. The company deployed GLM 5.3 with a 1,048,576-token context window, but the key-value (KV) cache pool on its prefill GPUs could hold only 681,280 tokens. Cloudflare knew about the mismatch before launch. During testing, however, the long-context requests returned successful HTTP status codes and streamed output with no error frames. The company assumed the engine would handle the gap on its own.

The second was a bug in SGLang, the open-source inference engine Cloudflare uses. When a prompt was too large for the pool, SGLang marked the request as rejected and swapped the prompt for a single-token placeholder. In the disaggregated setup Cloudflare runs, where one group of GPUs processes the prompt and another generates the response, that rejected request still moved through the system. The decode node reserved memory for the full prompt and then read pages that earlier requests had left behind. Those pages held other users' prompts and partial responses.

The result, Cloudflare said, was that affected users received an HTTP 200 success code instead of an error. The replies were coherent and arrived faster than a full prompt would take to process, which the company said was a sign something was wrong. Cloudflare said every request over the threshold followed the same path, so the failure was not a timing accident.

The SGLang bug had already been reported to the project by another user as issue #30233 on July 6, 2026. Cloudflare said it noticed that report while investigating this incident. The company said it had been flagging problems of this kind with SGLang since version 0.5.10, and the incident accelerated work it had already started with the project's maintainers.

What Cloudflare changed

How did Cloudflare fix the Workers AI flaw?

Cloudflare adjusted its GLM 5.3 configuration to match its GLM 5.2 setup. That freed enough GPU memory for the prefill pool to hold about 2.04 million tokens, roughly twice the model's context length. The company also patched its engine so that rejected requests return their original error before any memory is allocated or any data is transferred. The fix was submitted upstream as pull request #38704, and a related change, #38935, was merged by the SGLang maintainers.

Cloudflare met with the SGLang maintainers at RadixArk on September 10, the day after the incident. The company said the project has since released fixes in SGLang versions 0.5.20, 0.5.21 and 0.5.22, and it urged all operators to update to 0.5.22 or later. Cloudflare also rolled additional safeguards to its production SGLang deployments between September 11 and 19. Those include a per-transfer checksum that lets decode nodes verify the data they receive, and changes to how the company's load balancer handles client disconnects during transfers.

Cloudflare said it had also built a prototype that tags each memory page and checks those tags before the decode step reads the cache. The company said the prototype added less than 1 percent to throughput and tail latency in its tests. It was turned off in mid-August because of reliability problems, and Cloudflare said it is now working with the SGLang team on a production version.

The company thanked Evron for providing a clear, reproducible script and for allowing time to fix the problem before publishing. The postmortem was released as part of a coordinated disclosure with the researcher and RadixArk, the SGLang maintainers.

Este artículo fue escrito con la asistencia de IA.
News Factory APP - noticias agénticas para impulsar tu SEO y AEO.