155 GLM Replies Crossed Tenants. There Is No CVE.

US trends at 22:52 UTC on 26 October were the Ballon d'Or, Monday Night Football, and James Comey. GPT-6.1 Terra and Anthropic were on that list as a launch and a filing. Cloudflare's post carries a published timestamp of 2026-10-26T22:01:23.889Z. Hacker News item 50252159, created at 22:41:48 UTC, was on the front page. The read showed 14 points.

High High because Cloudflare says 155 responses on a shared model contained another customer's data. The vendor says the model was restored the same day it was pulled, and that the requests look like ordinary long-context use. There is still no CVE.

The pool was shorter than the window.#

The primary is Cloudflare, Kevin Flansburg and Michelle Chen. The model id is @cf/zai-org/glm-5.3. The page says the exposure was present from launch on 27 August 2026, and that line has no minute. Between 27 August and 9 September, 155 responses contained data from other customers' requests to the same model shortly before. Every one of those prompts was longer than 681,280 tokens. After excluding Cloudflare's own testing and the researcher's, the page says the timing and volume match ordinary long-context use. It says there was no evidence of deliberate exploitation. This brief did not retest that.

Gadi Evron of Knostic reported it through HackerOne. The timeline says the report arrived at 23:11 UTC on 8 September. Verification started at 08:00 UTC on 9 September. The incident was declared at 13:22 UTC. The same line says Product Security reproduced the leak with two independent accounts within 25 minutes. From 08:00 to 13:22 is 5 hours and 22 minutes. Do not fold that morning into the 25 minutes. The prose says the model was taken offline within 40 minutes of the declaration. The timeline puts the model in private at 14:00 UTC, which is 38 minutes after 13:22, and says requests then returned HTTP 400.

Two facts overlap, and the page keeps them separate. The context window was 1,048,576 tokens. The prefill KV pool held 681,280 tokens. Cloudflare says it knew about that mismatch before launch, expected an error for a prompt the pool could not hold, and saw successful responses in long-context tests. The second fact is in disaggregated prefill and decode. A prompt that did not fit was marked rejected and replaced with a one-token placeholder, and the handoff still ran. Decode generated while attending over cache pages this request had not written. The client got HTTP 200. This brief does not repeat the handoff as steps.

The status incident is a different record. The name is "Cloudflare Workers AI increased errors." The impact field is minor. The investigating update at 2026-09-09T14:25:16.719Z says Cloudflare was investigating increased errors when attempting to use GLM 5.3. Identified is 2026-09-09T15:02:41.584Z. Resolved is 2026-09-09T20:09:37.219Z, and the text is only that the incident has been resolved. From the blog's 14:00 private line to that investigating update is 25 minutes 16.719 seconds. From the blog's 19:40 restore to the status resolve is 29 minutes 37.219 seconds. The status page does not say another customer's data, and it does not say the model was restored.

The blog's later same-day lines are 14:35 UTC for the pool as the root cause, 14:52 UTC for the prefill rollout, 19:04 UTC for a full rebuild plus a Cloudflare-authored engine patch, and 19:40 UTC for the public restore. From 19:40 UTC on 9 September to the post timestamp is 47 days, 2 hours, 21 minutes, and 23.889 seconds. The page says no other Workers AI model was affected, because every other disaggregated deployment had a KV pool larger than its context length. The corrected GLM 5.3 pool is "about 2.04 million tokens," which the page also calls roughly twice the context length. That is their figure.

The SGLang post is dated 26 October 2026 and has no minute in the byline. It says Cloudflare notified the maintainers on 9 September, and that a researcher report will be available soon. No researcher URL was on either page tonight. SGLang repeats the two sizes and does not repeat 155. It says the single-node rejection path returned an error, and that the disaggregated path did not.

v0.5.22 is not the whole fix.#

There is no CVE. The SGLang repository advisory list is empty. The v0.5.20 release note mentions #36988 once, as the bullet "[VLM] Retire aborted disaggregated prefill results." That bullet does not say cross-request cache or a tenant.

Issue 30233 was opened at 2026-07-06T08:08:12Z by kevin-14. The title says an aborted prefill whose input is too long makes decode generate from an incomplete KV cache. A bot closed it at 2026-09-05T00:27:29Z for inactivity. The only comment is that automatic close. From the open to that close is 60 days, 16 hours, 19 minutes, and 17 seconds. Pull 30551, "fix(pd): propagate pre-queue aborts to decode," was opened at 2026-07-08T17:23:03Z by vuuihc and was still open on this read. Its updated_at is 2026-09-15T02:50:26Z. It is not the merged fix.

#36988 merged at 2026-09-06T02:15:33Z, 1 day, 1 hour, 48 minutes, and 4 seconds after the stale close. Compare against v0.5.20 is ahead, behind 0, so that merge is in the tag. Cloudflare's prose calls it a related failure path, merged 6 September and not yet released during the incident. The table on the same page says it stops the exposure in this incident and ships in v0.5.20. Keep both sentences. The SGLang post says #36988 retires aborted requests when their final prefill result is processed, and that #38935 is the earlier stop for intake-rejected requests.

#38935 merged at 2026-09-16T04:44:50Z. Compare against v0.5.20 is diverged. Compare against v0.5.21 and v0.5.22 is ahead, behind 0. #38704 is Cloudflare's draft. It was closed at 2026-10-10T18:26:02Z with no merge.

GitHub release v0.5.20 published at 2026-09-18T22:41:33Z. The annotated tag is 2026-09-18T08:02:22Z. PyPI 0.5.20's first file is 2026-09-18T09:54:39.398227Z. From the #36988 merge to that wheel is 12 days, 7 hours, 39 minutes, and 6.398 seconds. From the merge to the GitHub release object is 12 days, 20 hours, and 26 minutes.

GitHub release v0.5.21 published at 2026-10-02T01:09:04Z. The annotated tag is 2026-10-01T06:22:41Z. PyPI 0.5.21's first file is 2026-10-01T07:45:09.006773Z. From the #38935 merge to that wheel is 15 days, 3 hours, 0 minutes, and 19.007 seconds. Both vendor timelines say 2 October for v0.5.21, which matches the GitHub release object, not the registry and not the tag.

GitHub release v0.5.22 published at 2026-10-19T02:55:19Z. The annotated tag is 2026-10-15T23:39:11Z. PyPI 0.5.22 is six wheels, no sdist, none yanked. The first wheel is 2026-10-16T00:25:44.069863Z, 46 minutes and 33.070 seconds after the tag. latest tonight is 0.5.22. There is no 0.5.23. From that first wheel to the Cloudflare post is 10 days, 21 hours, 35 minutes, and 39.819 seconds. From the GitHub release object to the post is 7 days, 19 hours, 6 minutes, and 4.889 seconds. Cloudflare's "19 October" matches the release object.

#39729 merged at 2026-10-25T10:05:28Z. Compare against v0.5.22 is diverged. Compare against main is ahead, behind 0. Cloudflare says that checksum cleanup is merged and awaiting release. From the merge to the post is 1 day, 11 hours, 55 minutes, and 55.889 seconds. #45973 merged at 2026-10-23T06:48:00Z. It is an ancestor of main and not of v0.5.22. The SGLang timeline says it ships in v0.5.23. The registry has no such version. #37077 merged at 2026-10-03T08:51:11Z, is not in v0.5.21, and is in v0.5.22. #39500 merged at 2026-09-16T15:53:31Z, 11 hours, 8 minutes, and 41 seconds after #38935, and is in v0.5.21. #41023 merged at 2026-09-24T14:35:12Z and is in v0.5.21. The rest of Cloudflare's pull list was not retimed.

The SGLang post's range for the aborted-transfer race is not the 155. It says default disaggregated configurations were affected from the v0.4.x line, early 2025, until v0.5.21, or v0.5.22 for MORI. A single-instance deployment without that cross-engine transfer is not in that race. The post says a deployer has no reliable log line for whether the race already fired. This brief did not bisect v0.4.x, did not open the gist, and did not run a harness.

1. 2026-07-06
   Issue 30233 opened at 08:08:12Z. A bot closed it for inactivity at 00:27:29Z on 5 September. Pull 30551, opened 8 July, was still open.
2. 2026-08-27
   GLM 5.3 launched on Workers AI with the short prefill pool. No minute. The exposure was present from launch. 155 responses by 9 September, all over 681,280 tokens.
3. 2026-09-09
   Blog: private at 14:00 UTC, restored at 19:40 UTC. Status page: errors from 14:25:16Z, resolved 20:09:37Z, impact minor. The status text does not name the leak.
4. 2026-09-16
   #38935 merged at 04:44:50Z and is in v0.5.21, not in v0.5.20. #39500 merged at 15:53:31Z the same day.
5. 2026-10-16
   PyPI 0.5.22 first wheel at 00:25:44Z. GitHub release object 19 October at 02:55:19Z. #45973 wants v0.5.23. No 0.5.23 on the registry.
6. 2026-10-26
   Cloudflare post at 22:01:23.889Z. From the 19:40 restore to that timestamp is 47 days, 2 hours, 21 minutes, and 23.889 seconds. No CVE.

What to do with the three clocks.#

1. Keep the impact clock on Cloudflare's count. Launch on 27 August has no minute. The blog ends the customer window at 19:40 UTC on 9 September. 155 responses, model @cf/zai-org/glm-5.3, prompts longer than 681,280 tokens, context window 1,048,576. The page says the other Workers AI models did not take this path. It says the identified requests were not a repeated exploit. That is not a finding about every SGLang cluster.
2. Do not use the status page as the disclosure. "Increased errors," impact minor, resolved at 20:09:37 UTC on 9 September, is the public incident customers could see that day. It is 25 minutes 16.719 seconds after the blog's private line and 29 minutes 37.219 seconds after the blog's restore. It does not name cross-tenant cache.
3. Treat the package clock as three tags, not one. #36988 is in v0.5.20, and that note does not say tenant isolation. #38935 is in v0.5.21 and not in v0.5.20. Cloudflare's recommendation is a build with both, and the page says v0.5.22 or later. PyPI latest is 0.5.22, first wheel 2026-10-16T00:25:44.069863Z. The GitHub release object is 2026-10-19T02:55:19Z. #39729 and #45973 are on main and not in v0.5.22. There is no v0.5.23 on PyPI tonight. There is no CVE and no GitHub advisory.
4. Measure the KV pool against the context length on every prefill and decode node after any change to weights, quantization, parallelism, or memory fraction. Cloudflare says a successful HTTP status in a long-context test was the check that missed this. A proxy in front of the engine is not that measurement. The SGLang post says the admission fix is the backstop for the day the pool check is wrong.
5. Do not average the SGLang race into the 155. The post's "until v0.5.21, or v0.5.22 for MORI" sentence is the aborted-transfer class, which it says leaves no error line. This brief did not bisect early 2025 and did not open the gist. A single-node rejection path is the path SGLang says returned an error.
6. The disclosure clock is the 26 October post, 47 days, 2 hours, 21 minutes, and 23.889 seconds after the blog's restore. Hacker News created the item 40 minutes and 24.111 seconds later. The researcher writeup was still "available soon" on the SGLang page. Issue 30233 being closed did not mean the handoff was fixed. Pull 30551 being open does not mean #38935 failed to merge.