[{"data":1,"prerenderedAt":61},["Reactive",2],{"news-story-news-20261026-cloudflare-workers-ai-glm-5-3-kv-cache-cross-request-exposure-sglang":3},{"id":4,"title_zh":5,"title_en":6,"summary_zh":7,"summary_en":8,"takeaways_zh":9,"takeaways_en":15,"content_zh":21,"content_en":22,"external_links":23,"source":35,"category":42,"impact_score":43,"views_count":44,"likes_count":45,"related_entities":46,"tags":53,"image_url":60},"news-20261026-cloudflare-workers-ai-glm-5-3-kv-cache-cross-request-exposure-sglang","Cloudflare 披露 Workers AI 上 GLM-5.3 跨请求泄露事故：KV 缓存配置不匹配叠加 SGLang 漏洞，13 天内 155 条回复混入其他用户数据","Cloudflare discloses a cross-request KV cache leak in GLM-5.3 on Workers AI: a config mismatch plus an SGLang bug let 155 responses carry other users' data over 13 days","Cloudflare 10 月 26 日在官方博客发布事故报告：8 月 27 日至 9 月 9 日，Workers AI 上的 GLM-5.3（@cf/zai-org/glm-5.3）对超过 681,280 token 的长提示，有 155 条回复混入了其他用户刚发过的请求内容，且都返回 HTTP 200。原因是 prefill 节点 KV 缓存池小于 1,048,576 token 的上下文窗口，叠加 SGLang 在 prefill/decode 分离模式下处理超长请求的漏洞。Cloudflare 称未发现恶意利用，已修复并建议运营方升级到 SGLang v0.5.22 或更高版本。","In an Oct 26 incident report on its blog, Cloudflare said that between Aug 27 and Sep 9, 155 responses from GLM-5.3 on Workers AI (@cf/zai-org/glm-5.3) to prompts longer than 681,280 tokens contained data from other customers' recent requests, all returned with HTTP 200. The cause was a prefill KV cache pool smaller than the 1,048,576-token context window, combined with an SGLang bug in disaggregated prefill/decode mode. Cloudflare found no evidence of deliberate exploitation, has fixed it, and recommends operators upgrade to SGLang v0.5.22 or later.",[10,11,12,13,14],"影响范围：2026-08-27 至 09-09 共 155 条回复受影响，均为超过 681,280 token 的提示；Cloudflare 确认 Workers AI 其他模型未受影响","根因 1：GLM-5.3 上下文 1,048,576 token，但 prefill KV 池只有 681,280 token；修复后池容量约 204 万 token，约为上下文的 2 倍","根因 2：SGLang 把超长请求标记为拒绝并换成 1 token 占位，却没中止，decode 节点读到了未被覆盖的旧缓存页","响应：9 月 8 日经 HackerOne 收到 Knostic 的 Gadi Evron 报告，9 月 9 日宣布事故后 40 分钟内下线模型，当天 19:40 UTC 恢复","行动建议：自建 SGLang 的团队升级到 v0.5.22 或更高版本，并直接核对 KV 池大小与上下文长度",[16,17,18,19,20],"Scope: 155 responses between 2026-08-27 and 09-09, all to prompts over 681,280 tokens; Cloudflare confirmed no other Workers AI model was affected","Cause 1: GLM-5.3 advertised a 1,048,576-token context but the prefill KV pool held only 681,280 tokens; after the fix the pool holds about 2.04 million tokens, roughly twice the context","Cause 2: SGLang marked over-length requests as rejected and swapped in a one-token placeholder without aborting, so the decode node read stale cache pages from earlier requests","Response: report from Gadi Evron of Knostic via HackerOne on Sep 8; model taken offline within 40 minutes of declaring the incident on Sep 9 and restored at 19:40 UTC that day","Action: teams running SGLang should upgrade to v0.5.22 or later and check KV pool size against context length directly","### 核心背景与行业痛点\n推理服务为了性能，会让不同请求复用 GPU 上同一个 KV 缓存池的页面，页面在请求之间不清零，归属全靠推理引擎追踪。Cloudflare 这份报告说明，一旦追踪出错，用户拿到的是看似正常的 HTTP 200 回复，里面却夹着别人的提示和生成内容，传统监控完全看不出来。这是托管开源模型的云厂商普遍面临的租户隔离风险。\n\n### 架构亮点与底层机制\nWorkers AI 用 SGLang 以 prefill/decode 分离方式运行 GLM-5.3：prefill GPU 计算 KV 缓存后经 Mooncake 走 RDMA 传给 decode GPU。问题有两层：一是配置上下文 1,048,576 token，而 prefill KV 池只有 681,280 token，团队上线前知道差异，但以为引擎会报错；二是 SGLang 准入队列只检查请求是否 finished，被拒绝的请求仍被放行，prefill 只算 1 个 token 就报告传输完成，decode 读取其余未覆盖的旧页面后生成回复。\n\n### 权威 Benchmark 与实测跑分对比\n本事件没有跑分。官方口径的关键数字：155 条受影响回复，暴露期约 13 天；修复后 prefill KV 池约 204 万 token；从宣布事故到下线不到 40 分钟。修复已进入 SGLang v0.5.20，后续在 v0.5.21、v0.5.22 补强。\n\n### 开发者实战落地与开箱指南\n自建 SGLang 推理的团队应升级到 v0.5.22 或更高，并在每次部署变更前从运行中的引擎直接核对 KV 池大小是否不小于上下文长度，不要只凭 HTTP 状态码判断长上下文是否正常。压测时要检查输出内容和连贯性，可用金丝雀标记检测跨请求泄露。","### Core Background & Industry Pain Points\nFor performance, inference engines reuse pages of a shared GPU KV cache pool across requests without zeroing them, and the engine alone tracks ownership. Cloudflare's report shows what happens when that tracking fails: users get a normal-looking HTTP 200 reply that contains someone else's prompt and generations, invisible to conventional monitoring. It is a tenant-isolation risk for every cloud hosting open models.\n\n### Architecture Highlights & Internals\nWorkers AI runs GLM-5.3 on SGLang in disaggregated prefill/decode mode: prefill GPUs compute the KV cache and hand it over RDMA via Mooncake to decode GPUs. Two issues overlapped. The context was configured at 1,048,576 tokens while the prefill KV pool held only 681,280; the team knew but assumed the engine would return an error. And SGLang's admission queues checked only whether a request was finished, so rejected requests were admitted; prefill ran a one-token placeholder, reported the transfer complete, and decode generated over stale, unwritten pages.\n\n### Authoritative Benchmarks & Measured Scores\nThere are no benchmarks here. Key figures per Cloudflare: 155 affected responses over about 13 days; the fixed prefill pool holds about 2.04 million tokens; the model went offline within 40 minutes of the incident being declared. The engine fix shipped in SGLang v0.5.20, with follow-ups in v0.5.21 and v0.5.22.\n\n### Developer Hands-on Guide\nTeams self-hosting SGLang should upgrade to v0.5.22 or later and, before any deployment change, verify from the running engine that the KV pool is at least as large as the context length, rather than trusting HTTP status codes. Long-context tests should check output content and coherence, and canary markers can detect cross-request leakage.",[24,28,32],{"title":25,"url":26,"type":27},"Cloudflare Blog: Cross-request KV cache exposure in the GLM-5.3 Workers AI model","https://blog.cloudflare.com/kv-cache-exposure-remediation/","blog",{"title":29,"url":30,"type":31},"SGLang PR #38704: retire rejected requests at disaggregation admission","https://github.com/sgl-project/sglang/pull/38704","github",{"title":33,"url":34,"type":31},"SGLang v0.5.22 release","https://github.com/sgl-project/sglang/releases/tag/v0.5.22",{"platform":36,"author_name":37,"author_handle":38,"author_avatar":39,"tweet_url":40,"published_at":41},"x","Cloudflare","@Cloudflare","https://unavatar.io/x/Cloudflare","https://x.com/Cloudflare/status/2114848043853873286","2026-10-26T22:34:00.000Z","tooling",84,75,0,{"models":47,"agents":49,"vendors":50},[48],"zai-glm-5-3",[],[51,52],"cloudflare","zai",[37,54,55,56,57,58,59],"Workers AI","GLM-5.3","SGLang","KV cache","Security incident","Inference","https://blog.cloudflare.com/_emdash/api/media/file/01M5X2YJT16K16BFFJGEMCAXRS.01M5X2YM62P3YQRBGRP96FS4P6.png",1793718860858]