Cloudflare announced the fix for a security vulnerability that led to user data exposure (Tenant Isolation Issue) in the GLM-5.3 AI model available via the Workers AI platform. The issue caused parts of data from previous user requests to leak to other users, resulting from a technical overlap between the model settings and the inference engine used.
Incident Details and Affected Scope
The problem began on August 27, 2026, and was discovered on September 8, 2026, via the HackerOne program by security researcher Gadi Evron from Knostic. Cloudflare explained that the vulnerability affected only 155 responses, all of which were related to very long prompts exceeding 681,280 tokens.
The company reassured its users that there is no evidence of intentional exploitation of this vulnerability by external parties, and also confirmed that the issue was limited only to the GLM-5.3 model and did not extend to any other models hosted on the Workers AI platform.
How Did the Leakage Occur Technically?
The reason for this leakage is attributed to the combination of two technical factors: the first is a misconfiguration, where the GLM-5.3 model was launched with a context window of 1,048,576 tokens, while the Key-Value cache pool (KV cache pool) in the GPUs dedicated to the prefill process could only accommodate 681,280 tokens.
The second factor is a bug in the open-source inference engine SGLang. In the disaggregated mode used by Cloudflare, when a request arrived that exceeded the available memory capacity, the engine would replace the request with a single-token "placeholder." Instead of rejecting the request and sending an error to the client, the prefill process would send this placeholder to the decode node, which incorrectly assumed that the memory had been fully updated with the new data, while in reality, it still contained old cache pages belonging to other users' requests, leading to that data appearing in the new user's response.
Corrective Actions and Sustainable Solutions
Cloudflare took immediate steps to isolate the model and fix the flaw, which included:
- Configuration Adjustment: Increasing the size of the KV cache pool to accommodate twice the required context window (approximately 2.04 million tokens), ensuring that requests do not reach the software rejection path.
- SGLang Engine Patching: Working with SGLang developers to ensure that invalid requests are rejected at a very early stage before any data transfer process begins over the network.
- Security Enhancement: Applying additional improvements to all SGLang deployments to ensure the verification of transferred data integrity and to avoid race conditions between nodes.
Why Does This News Matter?
This incident highlights the complex security challenges in multi-tenant cloud AI environments. As companies move toward disaggregated inference architecture to increase efficiency and speed, managing "memory page ownership" becomes critical. Any error in coordination between prefill and decode nodes could lead to the leakage of sensitive data through shared memory, making data integrity verification in distributed systems a security necessity no less important than traditional data encryption.