Cloudflare修复GLM-5.3模型跨请求KV缓存暴露漏洞

2026年9月，安全研究人员披露了Cloudflare Workers AI平台上GLM-5.3模型存在的租户隔离缺陷，该问题导致部分用户的长上下文请求中意外包含其他用户的数据 1。这一跨请求KV缓存暴露漏洞的影响期间为2026年8月27日至9月9日，最终确认共有155个响应受到影响，这些请求的提示词长度均超过681,280个token 1。漏洞的发现者是来自Knostic的安全研究员Gadi Evron，他通过HackerOne平台提交了相关报告 1。

调查指出，该事件的根本原因涉及配置错误与代码缺陷两方面：首先，KV缓存池的大小（681,280 tokens）小于模型的上下文窗口（1,048,576 tokens），构成了潜在风险；其次，SGLang推理引擎在分离式prefill/decode模式下存在bug，使得被拒绝的请求未能正确终止，导致解码节点读取到了残留的其他用户KV缓存页 1。Cloudflare于9月8日收到报告后，在40分钟内下线了受影响的模型进行紧急修复，并于次日即9月9日恢复服务 1。具体的修复措施包括调整配置以确保KV池大于上下文长度、打补丁保证被拒绝请求在交接前退役，以及升级至SGLang v0.5.22版本或应用相关的PR补丁（如#36988和#38935等） 1。双方联合发布的披露报告强调，目前无证据表明该漏洞被蓄意利用，受影响情况仅符合正常长上下文使用的特征 1。

Security researcher Gadi Evron from Knostic reported a tenant isolation vulnerability affecting the GLM-5.3 model (@cf/zai-org/glm-5.3) on the Cloudflare Workers AI platform, which resulted in cross-request KV cache exposure 1. The vulnerability window occurred between August 27 and September 9, 2026 1. A total of 155 responses were identified as affected, all involving prompts exceeding 681,280 tokens 1.

The root cause stemmed from two primary issues within the SGLang inference engine developed by RadixArk 1. First, a configuration error caused the KV cache pool size (681,280 tokens) to be smaller than the model's context window (1,048,576 tokens) 1. Second, a bug in SGLang meant that in separated prefill/decode modes, rejected requests failed to terminate correctly, allowing decode nodes to access residual KV cache pages belonging to other users 1.

Cloudflare received the report via HackerOne on September 8, 2026 1. In response, the company took the model offline for remediation within 40 minutes and restored service the following day 1. Fix measures included adjusting configurations to ensure the KV pool exceeds the context length and patching the system to properly retire rejected requests before handoff 1. Additionally, upgrades to SGLang v0.5.22 or the application of specific pull requests (#36988, #38935) were implemented 1. Joint disclosure reports confirmed there was no evidence of malicious exploitation, noting that the leaked data aligned only with normal long-context usage patterns 1.