# 155 GLM Replies Crossed Tenants. There Is No CVE. > Cloudflare published the GLM 5.3 report at 22:01 UTC on 26 October 2026. It says 155 Workers AI responses contained another customer's data, each from a prompt longer than 681,280 tokens. The model was restored at 19:40 UTC on 9 September. SGLang 0.5.22 is on PyPI. There is no CVE. The status page names errors, not the leak. Source: https://hackerlogs.com/blog/glm-kv-pool-disclosure-clock Published: 2026-10-26 ## Key takeaways - Cloudflare's post at 22:01:23 UTC on 26 October says 155 GLM 5.3 responses on Workers AI contained another customer's data. Every one of those prompts was longer than 681,280 tokens. - The blog restores the model at 19:40 UTC on 9 September. The status page for that day starts at 14:25 UTC, calls the impact minor, and says increased errors. It does not name a cross-tenant leak. - SGLang 0.5.22 is latest on PyPI, first wheel 16 October. The GitHub release object is 19 October. #39729 merged 25 October and is not in that tag. There is no 0.5.23 and no CVE. - Issue 30233 was closed for inactivity on 5 September. The admission fix Cloudflare names, #38935, merged on 16 September and is in v0.5.21. The v0.5.20 note for #36988 does not say tenant isolation. US trends at 22:52 UTC on 26 October were the Ballon d'Or, Monday Night Football, and James Comey. GPT-6.1 Terra and Anthropic were on that list as a launch and a filing. [Cloudflare's post](https://blog.cloudflare.com/kv-cache-exposure-remediation/) carries a published timestamp of 2026-10-26T22:01:23.889Z. Hacker News item 50252159, created at 22:41:48 UTC, was on the front page. The read showed 14 points. High because Cloudflare says 155 responses on a shared model contained another customer's data. The vendor says the model was restored the same day it was pulled, and that the requests look like ordinary long-context use. There is still no CVE. Three panels for the GLM 5.3 KV pool: 155 replies past a short cache, a status page that says errors, and an SGLang 0.5.22 release that is not the tip of main. ## The pool was shorter than the window. The primary is Cloudflare, Kevin Flansburg and Michelle Chen. The model id is `@cf/zai-org/glm-5.3`. The page says the exposure was present from launch on 27 August 2026, and that line has no minute. Between 27 August and 9 September, 155 responses contained data from other customers' requests to the same model shortly before. Every one of those prompts was longer than 681,280 tokens. After excluding Cloudflare's own testing and the researcher's, the page says the timing and volume match ordinary long-context use. It says there was no evidence of deliberate exploitation. This brief did not retest that. Gadi Evron of Knostic reported it through HackerOne. The timeline says the report arrived at 23:11 UTC on 8 September. Verification started at 08:00 UTC on 9 September. The incident was declared at 13:22 UTC. The same line says Product Security reproduced the leak with two independent accounts within 25 minutes. From 08:00 to 13:22 is 5 hours and 22 minutes. Do not fold that morning into the 25 minutes. The prose says the model was taken offline within 40 minutes of the declaration. The timeline puts the model in private at 14:00 UTC, which is 38 minutes after 13:22, and says requests then returned HTTP 400. Two facts overlap, and the page keeps them separate. The context window was 1,048,576 tokens. The prefill KV pool held 681,280 tokens. Cloudflare says it knew about that mismatch before launch, expected an error for a prompt the pool could not hold, and saw successful responses in long-context tests. The second fact is in disaggregated prefill and decode. A prompt that did not fit was marked rejected and replaced with a one-token placeholder, and the handoff still ran. Decode generated while attending over cache pages this request had not written. The client got HTTP 200. This brief does not repeat the handoff as steps. The [status incident](https://www.cloudflarestatus.com/incidents/jsvvrtk5hvym) is a different record. The name is "Cloudflare Workers AI increased errors." The impact field is minor. The investigating update at 2026-09-09T14:25:16.719Z says Cloudflare was investigating increased errors when attempting to use GLM 5.3. Identified is 2026-09-09T15:02:41.584Z. Resolved is 2026-09-09T20:09:37.219Z, and the text is only that the incident has been resolved. From the blog's 14:00 private line to that investigating update is 25 minutes 16.719 seconds. From the blog's 19:40 restore to the status resolve is 29 minutes 37.219 seconds. The status page does not say another customer's data, and it does not say the model was restored. The blog's later same-day lines are 14:35 UTC for the pool as the root cause, 14:52 UTC for the prefill rollout, 19:04 UTC for a full rebuild plus a Cloudflare-authored engine patch, and 19:40 UTC for the public restore. From 19:40 UTC on 9 September to the post timestamp is 47 days, 2 hours, 21 minutes, and 23.889 seconds. The page says no other Workers AI model was affected, because every other disaggregated deployment had a KV pool larger than its context length. The corrected GLM 5.3 pool is "about 2.04 million tokens," which the page also calls roughly twice the context length. That is their figure. The [SGLang post](https://www.lmsys.org/blog/2026-10-26-cf-security) is dated 26 October 2026 and has no minute in the byline. It says Cloudflare notified the maintainers on 9 September, and that a researcher report will be available soon. No researcher URL was on either page tonight. SGLang repeats the two sizes and does not repeat 155. It says the single-node rejection path returned an error, and that the disaggregated path did not. ## v0.5.22 is not the whole fix. There is no CVE. The SGLang repository advisory list is empty. The v0.5.20 release note mentions #36988 once, as the bullet "[VLM] Retire aborted disaggregated prefill results." That bullet does not say cross-request cache or a tenant. [Issue 30233](https://github.com/sgl-project/sglang/issues/30233) was opened at 2026-07-06T08:08:12Z by kevin-14. The title says an aborted prefill whose input is too long makes decode generate from an incomplete KV cache. A bot closed it at 2026-09-05T00:27:29Z for inactivity. The only comment is that automatic close. From the open to that close is 60 days, 16 hours, 19 minutes, and 17 seconds. Pull 30551, "fix(pd): propagate pre-queue aborts to decode," was opened at 2026-07-08T17:23:03Z by vuuihc and was still open on this read. Its `updated_at` is 2026-09-15T02:50:26Z. It is not the merged fix. [#36988](https://github.com/sgl-project/sglang/pull/36988) merged at 2026-09-06T02:15:33Z, 1 day, 1 hour, 48 minutes, and 4 seconds after the stale close. Compare against v0.5.20 is ahead, behind 0, so that merge is in the tag. Cloudflare's prose calls it a related failure path, merged 6 September and not yet released during the incident. The table on the same page says it stops the exposure in this incident and ships in v0.5.20. Keep both sentences. The SGLang post says #36988 retires aborted requests when their final prefill result is processed, and that #38935 is the earlier stop for intake-rejected requests. [#38935](https://github.com/sgl-project/sglang/pull/38935) merged at 2026-09-16T04:44:50Z. Compare against v0.5.20 is diverged. Compare against v0.5.21 and v0.5.22 is ahead, behind 0. [#38704](https://github.com/sgl-project/sglang/pull/38704) is Cloudflare's draft. It was closed at 2026-10-10T18:26:02Z with no merge. GitHub release v0.5.20 published at 2026-09-18T22:41:33Z. The annotated tag is 2026-09-18T08:02:22Z. PyPI 0.5.20's first file is 2026-09-18T09:54:39.398227Z. From the #36988 merge to that wheel is 12 days, 7 hours, 39 minutes, and 6.398 seconds. From the merge to the GitHub release object is 12 days, 20 hours, and 26 minutes. GitHub release v0.5.21 published at 2026-10-02T01:09:04Z. The annotated tag is 2026-10-01T06:22:41Z. PyPI 0.5.21's first file is 2026-10-01T07:45:09.006773Z. From the #38935 merge to that wheel is 15 days, 3 hours, 0 minutes, and 19.007 seconds. Both vendor timelines say 2 October for v0.5.21, which matches the GitHub release object, not the registry and not the tag. GitHub release v0.5.22 published at 2026-10-19T02:55:19Z. The annotated tag is 2026-10-15T23:39:11Z. PyPI 0.5.22 is six wheels, no sdist, none yanked. The first wheel is 2026-10-16T00:25:44.069863Z, 46 minutes and 33.070 seconds after the tag. `latest` tonight is 0.5.22. There is no 0.5.23. From that first wheel to the Cloudflare post is 10 days, 21 hours, 35 minutes, and 39.819 seconds. From the GitHub release object to the post is 7 days, 19 hours, 6 minutes, and 4.889 seconds. Cloudflare's "19 October" matches the release object. [#39729](https://github.com/sgl-project/sglang/pull/39729) merged at 2026-10-25T10:05:28Z. Compare against v0.5.22 is diverged. Compare against main is ahead, behind 0. Cloudflare says that checksum cleanup is merged and awaiting release. From the merge to the post is 1 day, 11 hours, 55 minutes, and 55.889 seconds. [#45973](https://github.com/sgl-project/sglang/pull/45973) merged at 2026-10-23T06:48:00Z. It is an ancestor of main and not of v0.5.22. The SGLang timeline says it ships in v0.5.23. The registry has no such version. [#37077](https://github.com/sgl-project/sglang/pull/37077) merged at 2026-10-03T08:51:11Z, is not in v0.5.21, and is in v0.5.22. [#39500](https://github.com/sgl-project/sglang/pull/39500) merged at 2026-09-16T15:53:31Z, 11 hours, 8 minutes, and 41 seconds after #38935, and is in v0.5.21. [#41023](https://github.com/sgl-project/sglang/pull/41023) merged at 2026-09-24T14:35:12Z and is in v0.5.21. The rest of Cloudflare's pull list was not retimed. The SGLang post's range for the aborted-transfer race is not the 155. It says default disaggregated configurations were affected from the v0.4.x line, early 2025, until v0.5.21, or v0.5.22 for MORI. A single-instance deployment without that cross-engine transfer is not in that race. The post says a deployer has no reliable log line for whether the race already fired. This brief did not bisect v0.4.x, did not open the gist, and did not run a harness. > v0.5.21 already contains #36988 and #38935. v0.5.22 adds #37077 and is what Cloudflare tells operators to run. It does not contain #39729 or #45973, and PyPI has nothing newer. The v0.5.20 note does not name a tenant. The 9 September status page does not either. A resolved error incident is not this post. There is no CVE to file the package against. ## What to do with the three clocks. 1. Keep the impact clock on Cloudflare's count. Launch on 27 August has no minute. The blog ends the customer window at 19:40 UTC on 9 September. 155 responses, model `@cf/zai-org/glm-5.3`, prompts longer than 681,280 tokens, context window 1,048,576. The page says the other Workers AI models did not take this path. It says the identified requests were not a repeated exploit. That is not a finding about every SGLang cluster. 2. Do not use the status page as the disclosure. "Increased errors," impact minor, resolved at 20:09:37 UTC on 9 September, is the public incident customers could see that day. It is 25 minutes 16.719 seconds after the blog's private line and 29 minutes 37.219 seconds after the blog's restore. It does not name cross-tenant cache. 3. Treat the package clock as three tags, not one. #36988 is in v0.5.20, and that note does not say tenant isolation. #38935 is in v0.5.21 and not in v0.5.20. Cloudflare's recommendation is a build with both, and the page says v0.5.22 or later. PyPI `latest` is 0.5.22, first wheel 2026-10-16T00:25:44.069863Z. The GitHub release object is 2026-10-19T02:55:19Z. #39729 and #45973 are on main and not in v0.5.22. There is no v0.5.23 on PyPI tonight. There is no CVE and no GitHub advisory. 4. Measure the KV pool against the context length on every prefill and decode node after any change to weights, quantization, parallelism, or memory fraction. Cloudflare says a successful HTTP status in a long-context test was the check that missed this. A proxy in front of the engine is not that measurement. The SGLang post says the admission fix is the backstop for the day the pool check is wrong. 5. Do not average the SGLang race into the 155. The post's "until v0.5.21, or v0.5.22 for MORI" sentence is the aborted-transfer class, which it says leaves no error line. This brief did not bisect early 2025 and did not open the gist. A single-node rejection path is the path SGLang says returned an error. 6. The disclosure clock is the 26 October post, 47 days, 2 hours, 21 minutes, and 23.889 seconds after the blog's restore. Hacker News created the item 40 minutes and 24.111 seconds later. The researcher writeup was still "available soon" on the SGLang page. Issue 30233 being closed did not mean the handoff was fixed. Pull 30551 being open does not mean #38935 failed to merge. ## Sources - [Cross-request KV cache exposure in the GLM-5.3 Workers AI model](https://blog.cloudflare.com/kv-cache-exposure-remediation/) (2026-10-26) - [SGLang security update: improving request isolation](https://www.lmsys.org/blog/2026-10-26-cf-security) (2026-10-26) - [Cloudflare Workers AI increased errors](https://www.cloudflarestatus.com/incidents/jsvvrtk5hvym) (2026-09-09) - [SGLang v0.5.22](https://github.com/sgl-project/sglang/releases/tag/v0.5.22) (2026-10-19) - [sglang on PyPI](https://pypi.org/project/sglang/) (2026-10-16) - [SGLang issue 30233](https://github.com/sgl-project/sglang/issues/30233) (2026-07-06)