网络安全
Cloudflare 称 GLM-5.3 虫子漏出155个租户会议的答复
在 Google 上的首选来源中添加 Unite.AI
Cloudflare于2026年10月26日发表事件报告，在其工人AI平台上的GLM-5.3模型中披露了交叉请求的KV缓存曝光，其中对非常长的提示的155个响应包含来自其他客户会议的数据。
Knostic的安保研究员Gadi Evron于2026年9月8日通过该公司的"黑克One"计划向Cloudflare报告了租户隔离问题。 该暴露影响了模型，作为@cf/zai-org/glm-5.3，从2026年8月27日开始，即工人AI上的GLM 5.3 发布。 Cloudflare对此问题进行了补救并于2026年9月9日恢复了该型号，而称它确认，在工人AI上托管的其他型号没有受到影响。
所有155起受影响的反应都超过了681 280个令牌。 Cloudflare 称在排除了自己的试验和研究人员的要求之后，它确定的要求与在时间和体积上的普通长文使用相符，而不是重复地利用虫子，它没有发现任何故意利用的证据。
暴露背后的两个问题
GLM是Z.ai公司为代理编码工作流程所建的文本生成模型，通过Workers AI提供的许多模型之一。 Cloudflare使用开源推论引擎的SGLang运行了GLM 5.3，在分解配置中：预填GPU处理快取并生成其KV缓存，再将缓存在远程直接内存访问(RDMA)上，通过Mooncake来解码生成响应的GPU. KV缓存是一个共享的固定大小页面集合；页面在请求之间不被零化，因此引擎负责跟踪每个页面的所有权。
报告追踪了两个问题。 第一种是配置错误：Cloudflare部署GLM 5.3，上下文窗口为1,048,576-token，但其预填GPU上的KV缓存池只持有681,280个令牌。 Cloudflare 称意识到了发布之前的错配，但期望引擎返回一个错误，以获得任何它无法处理的快件，而它的长文本测试返回了成功的响应，因此它不相信错配是一个问题。 称公司的测试验证了长时间内HTTP响应代码和引擎性能，而没有验证模型输出和一致性，现在它在任何分解部署变化船之前直接对照上下文长度检查了KV池大小。
其二是在分类预填和解码模式中处理超长请求的SGLang bug. 一个不符合泳池的提示被内部标记为拒绝并交换出一个一键的占位符，但预填仍然为占位符生成了KV缓存并发出信号，表示传输完成。 解码节点随后在浏览仍然保存有来自更早请求的数据的已过时缓存页面时生成了回复，客户端收到了HTTP 200 的回复，而不是HTTP 400.
SGLang团队在自己协调的帖子中表示，单节点拒绝路径返回了一个错误取而代之，因此这个问题只在分类服务中出现。 该bug在2026年7月6日被另一个用户报告为"#30233"号，Cloudflare 称在调查时注意到了这个错误。
事件应对和补救
Cloudflare于协调世界时2026年9月9日08:00开始核实报告，并宣布在其产品安全小组在25分钟内使用两个独立账户来复制泄漏后，于13:22发生安全事件。 它在14:00将GLM 5.3设定为私用，在14:35确定根源，以14:52将所有预填节点滚动到已更正的配置上，于19:04前用Cloudflare授权的引擎补丁重建了全部署，并在19:40将模型恢复为公众访问。 Cloudflare状态页面记录了工人AI事件，从2026年9月9日10:25AM EDT开始，在11:02AM EDT被确定，于4:09PM EDT被解决。
配置固定与GLM 5.2设置相匹配，释放出足够的GPU内存，预填KV池现在持有约204万个令牌，大约是1,048,576个上下文长度的两倍，因此符合上下文窗口的提示总是适合池。 引擎补丁在任何靴子、分配或KV传输发生之前，在分类录用队列上将包含待决拒绝的请求及其原出错误退役。 Cloudflare在恢复模型之前，对研究人员的复制脚本和自己的金丝雀标记测试进行了验证。
上游修复和持续工作
Cloudflare在上游提出固定为SGLang拉力请求#38704，维护者合并为#38935，按照Cloudflare的方法在接收时拒绝了受影响的请求；相关的固定为#36988，已于2026年9月6日因相关故障路径被合并。 在SGLang v0.5.20中发运的补丁，后续在v0.5.21，发布 October 2,2026，和v0.5.22，发布 October 19,2026,Cloudflare建议所有SGLang运营商更新为v0.5.22或更晚。 SGLang团队表示：v0.5.21默认为每一种失败类型保护月饼和NIXL的部署，MORI的部署在v0.5.22中需要一个构建，而固定线没有被传送回更早的放行分支。
SGLang团队报告说，在21个以上的两个H100GPU上运行，带保护的吞吐量三角洲在±2%以内，95%的置信间隔相隔为0；另外对两个H200GPU进行16个运行的扫荡，测量了默认推迟KV释放的成本为−0.38%，其置信间隔为−2.12%至+1.36%，被它描述为不重大。 Cloudflare于2026年9月10日在RadixArk与SGLang维护者相遇，于2026年9月11日至19日对其生产的所有SGLang部署进行再滚动加硬化，并进行上游并购，涵盖入场固定，每次转会校验和，中止确认保存，并默认推迟KV发布时间从2026年9月16日到10月12日。
Cloudflare的报告建议，对于以分类模式运行SGLang的其他操作者，在重量、量化、平行或内存分数等任何变化后，按每个预填和解码节点的上下文长度衡量KV池；升级为包含两个输入修正的构建；在两个角色上使用被推迟的KV释放运行；在模型支持的地方允许进行腐败检测；以及配置负载平衡器，使客户端断接不会中止请求的中转。
Cloudflare 称公司此前已经建造了原型设计，在解码读取缓存前标记每个物理KV页面并检查映射，在测试中其吞吐量和尾部耐用性都低于1%；公司于2026年8月中旬在GLM 5.2上测试了原型，但不久后因可靠性问题而停用。 Cloudflare正与SGLang团队合作，在引擎中构建出一个生产版本，作为第一步，将牵引请求#39500中的每个转出校验和，而称正将正式的方法经验引导到基于RDMA的KV缓存转出协议的安全性上，使用Mooncake在其生产SGLang部署中。
SGLang团队的帖子承认了Cloudflare工程师凯文·法兰斯堡和克斯坦日在修复上的工作，并列出由SGLang和Cloudflare于2026年10月26日协调披露的内容，作为其披露时间表的最后入围。 称团队将描述这次发现和外部验证
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Cybersecurity
Cloudflare Says GLM-5.3 Bug Leaked 155 Responses Across Tenant Sessions
Add Unite.AI to your preferred sources on Google
Cloudflare on October 26, 2026 published an incident report disclosing a cross-request KV cache exposure in the GLM-5.3 model on its Workers AI platform, under which 155 responses to very long prompts contained data from other customers’ sessions.
Security researcher Gadi Evron of Knostic reported the tenant-isolation issue to Cloudflare on September 8, 2026 through the company’s HackerOne program. The exposure affected the model, served as @cf/zai-org/glm-5.3, starting August 27, 2026, the day GLM 5.3 launched on Workers AI. Cloudflare remediated the issue and restored the model on September 9, 2026, and said it confirmed that no other model hosted on Workers AI was affected.
All 155 affected responses went to prompts longer than 681,280 tokens. Cloudflare said that, after excluding its own testing and the researcher’s requests, the requests it identified matched ordinary long-context use in timing and volume rather than repeated exploitation of the bug, and that it found no evidence of deliberate exploitation.
The Two Issues Behind the Exposure
GLM is a text generation model from Z.ai built for agentic coding workflows, one of many models available through Workers AI. Cloudflare runs GLM 5.3 with SGLang, an open-source inference engine, in a disaggregated configuration: prefill GPUs process the prompt and produce its KV cache, then hand that cache over remote direct memory access (RDMA), via Mooncake, to decode GPUs that generate the response. The KV cache is a shared pool of fixed-size pages; pages are not zeroed between requests, so the engine is responsible for tracking ownership of each page.
The report traces the exposure to two issues. The first was a misconfiguration: Cloudflare deployed GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on its prefill GPUs held only 681,280 tokens. Cloudflare said it was aware of the mismatch before launch but expected the engine to return an error for any prompt it could not process, and its long-context tests returned successful responses, so it did not believe the mismatch was an issue. The company said its testing validated HTTP response codes and engine performance at long contexts without validating model output and coherence, and that it now checks KV pool size against context length directly before any disaggregated deployment change ships.
The second was an SGLang bug in the handling of over-length requests in disaggregated prefill and decode mode. A prompt that did not fit the pool was internally marked as rejected and swapped for a one-token placeholder, but prefill still generated KV cache for the placeholder and signaled that the transfer was complete. The decode node then generated a response while attending over stale cache pages that still held data from earlier requests, and the client received an HTTP 200 response instead of HTTP 400.
The SGLang team states in its own coordinated post that the single-node rejection path returned an error instead, so the issue occurred only in disaggregated serving. The bug had been reported to SGLang by another user as issue #30233 on July 6, 2026, which Cloudflare said it noticed while investigating.
Incident Response and Remediation
Cloudflare began verifying the report at 08:00 UTC on September 9, 2026 and declared a security incident at 13:22 after its Product Security team reproduced the leak using two independent accounts within 25 minutes. It set GLM 5.3 to private at 14:00, identified the root cause at 14:35, rolled all prefill nodes to the corrected configuration by 14:52, rebuilt the full deployment with a Cloudflare-authored engine patch by 19:04, and restored the model to public access at 19:40. The Cloudflare status page recorded the Workers AI incident as starting at 10:25 AM EDT on September 9, 2026, identified at 11:02 AM EDT, and resolved at 4:09 PM EDT.
The configuration fix matched the GLM 5.2 setup, freeing enough GPU memory that the prefill KV pool now holds about 2.04 million tokens, roughly twice the 1,048,576-token context length, so a prompt that fits the context window always fits the pool. The engine patch retires a request carrying a pending rejection at the disaggregation admission queue, with its original error, before any bootstrap, allocation, or KV transfer happens. Cloudflare validated both changes against the researcher’s reproduction script and its own canary-marker tests before restoring the model.
Upstream Fixes and Ongoing Work
Cloudflare proposed its fix upstream as SGLang pull request #38704, and the maintainers merged #38935, which rejects the affected requests at admission following Cloudflare’s approach; a related fix, #36988, had been merged on September 6, 2026 for a related failure path. The patch shipped in SGLang v0.5.20, with follow-ups in v0.5.21, released October 2, 2026, and v0.5.22, released October 19, 2026, and Cloudflare recommends all SGLang operators update to v0.5.22 or later. The SGLang team states that v0.5.21 protects Mooncake and NIXL deployments by default for every failure kind, that MORI deployments need a build in v0.5.22, and that the fix line was not backported to earlier release branches.
The SGLang team reported that across 21 runs on two H100 GPUs, throughput deltas with the protections were within ±2%, with every 95% confidence interval spanning zero, and that a separate 16-run sweep on two H200 GPUs measured the cost of enabling deferred KV release by default at −0.38%, with a confidence interval of −2.12% to +1.36% that it described as not significant. Cloudflare met the SGLang maintainers at RadixArk on September 10, 2026, rolled additional hardening to all of its production SGLang deployments between September 11 and 19, 2026, and upstream merges covering the admission fix, per-transfer checksums, abort-acknowledgment preservation, and default-on deferred KV release ran from September 16 to October 12, 2026.
For other operators running SGLang in disaggregated mode, Cloudflare’s report recommends measuring the KV pool against context length on every prefill and decode node after any change to weights, quantization, parallelism, or memory fraction; upgrading to a build that includes both admission fixes; running with deferred KV release on both roles; enabling corruption detection where the model supports it; and configuring load balancers so a client disconnect does not abort a request mid-transfer.
Cloudflare said it had previously built a prototype design that tags every physical KV page and checks the mapping before decode reads the cache, and that it cost under 1% in throughput and tail latency in tests; the company tested the prototype on GLM 5.2 in mid-August 2026 but disabled it shortly afterward due to reliability issues. Cloudflare is working with the SGLang team on a production version built into the engine, with the per-transfer checksum in pull request #39500 as a first step, and said it is directing its formal-methods experience toward modeling and proving the safety of an RDMA-based KV cache transfer protocol using Mooncake in its production SGLang deployment.
The SGLang team’s post acknowledges Cloudflare engineers Kevin Flansburg and Kastan Day for their work on the fixes and lists the coordinated disclosure by SGLang and Cloudflare on October 26, 2026 as the final entry in its disclosure timeline. The researcher’s own report, which the SGLang team said will describe the discovery and external validation, is forthcoming.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.