SGLang streaming sessions could reuse one physical KV slot across separate cache namespaces

A cache salt is meant to separate the histories of distinct inference contexts. The SGLang issue describes a narrower but dangerous failure: a streaming session borrowed cached KV memory under one namespace, then reinserted the same physical row under another after a changed salt, LoRA path or multimodal context.

Two logical cache nodes could then reference the same physical slot. Eviction could free that slot while a second namespace still considered it live, exposing subsequent requests to overwritten context. The issue and proposed patch document an ownership/correctness bug, not a reproduced theft of another tenant’s secret. The fix proposal binds a session to its initial cache namespace and refuses changing it while memory is borrowed.

Logical namespace separation does not protect data when two keys share the same underlying memory ownership. The public issue demonstrates a plausible cache integrity and cross-principal isolation problem, but there is no independently verified output of one tenant's secret into another. The proposed repair must be tested for the borrow, abort, evict and reuse sequence before claiming resolved confidentiality.