The serving configuration advertised a longer input context than the effective cache capacity. A prefill rejection did not reliably stop the downstream decode stage, creating a path for state from another request to enter a response. Cloudflare reports 155 AI responses containing content from another customer during an incident window from August 27…
Inspect the ClaimsCase · DiggingBeagle record
Cloudflare inference rejection path leaked another tenant’s cached content
Cloudflare disclosed 155 affected AI responses after a rejected prefill request left cross-customer KV-cache state reachable by decoding.
Scope
This is disclosed production cross-tenant output contamination, not evidence that an attacker deliberately forced the leak or that all requests on the platform were exposed.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
Cloudflare describes 155 actual cross-customer responses on GLM-5.3 between August 27 and September 9 and explains the prefill rejection/decode mismatch. The provider reports disabling, patching and canary tests; it reports no deliberate exploitation. The SGLang RDMA cancellation finding is separate. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-002-A · CLM-CP22-002-B · CLM-ENRICH-20261028-003 · Cloudflare GLM-5.3 cross-customer KV-cache exposure postmortem
At a glance
The precise sensitivity of every exposed response and whether all downstream copies were removed are not established by the public postmortem. The public material does not establish whether all customer-retained copies of affected completions were deleted or whether third parties re-shared them.
Limits and uncertaintyFull account
The serving configuration advertised a longer input context than the effective cache capacity. A prefill rejection did not reliably stop the downstream decode stage, creating a path for state from another request to enter a response.
Cloudflare reports 155 AI responses containing content from another customer during an incident window from August 27 through September 9, 2026. The documented serving mismatch was a 1,048,576-token advertised context against an approximately 681,280-token effective KV-cache limit, with a rejected prefill entering a decode path that returned HTTP 200. Primary evidence.
This is disclosed production cross-tenant output contamination, not evidence that an attacker deliberately forced the leak or that all requests on the platform were exposed.
Make decode contingent on successful prefill, reject over-limit contexts before cache allocation, and clear tenant-owned KV state on all aborted request paths.
Claims & evidence
CLM-CP22-002-ACloudflare reports 155 AI responses containing content from another customer during an incident window from August 27 through September 9, 2026.supported
Basis: reported finding
- supportsCloudflare GLM-5.3 cross-customer KV-cache exposure postmortemprimary disclosure
Incident postmortem; Impact and timeline
CLM-CP22-002-BThe documented serving mismatch was a 1,048,576-token advertised context against an approximately 681,280-token effective KV-cache limit, with a rejected prefill entering a decode path that returned HTTP 200.supported
Basis: reported finding
- supportsCloudflare GLM-5.3 cross-customer KV-cache exposure postmortemprimary disclosure
Technical root cause; Context length and prefill/decode handling
CLM-ENRICH-20261028-003Cloudflare says it disabled GLM-5.3, enlarged the cache pool to approximately 2.04 million tokens, and fixed rejection handling before restoring access on September 9; it found no evidence of deliberate exploitation.supported
Basis: reported finding
- supportsCloudflare GLM-5.3 cross-customer KV-cache exposure postmortemprimary disclosure
Immediate remediation and incident impact, October 26 postmortem
Controls and mitigations
- Make decode contingent on successful prefill, reject over-limit contexts before cache allocation, and clear tenant-owned KV state on all aborted request paths.
Unknowns and contradictions
- The precise sensitivity of every exposed response and whether all downstream copies were removed are not established by the public postmortem.
- The public material does not establish whether all customer-retained copies of affected completions were deleted or whether third parties re-shared them.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199