2026 Cloudflare — cross-request KV-cache bug in GLM-5.3 Workers AI returned other customers' prompt data in 155 responses
Data compromised
Other customers' prompt and output data in affected responses. Cloudflare says 155 responses were affected, from a small number of customers; it has not published a customer count.
Technical writeup
Cloudflare's own report was read directly (blog post dated October 26, 2026). This is a bug-driven cross-tenant data exposure rather than attacker access; it is included on the same basis as cloudflare-containers-cross-tenant2026.
Root cause
Cloudflare says a misconfigured SGLang inference engine, combined with a bug in how it handled over-length requests, sent responses containing data from other customers' recent requests to the same model. A researcher reported it through HackerOne on September 8; the issue ran from August 27 to September 9, 2026. Cloudflare says it found no evidence of deliberate exploitation.