Cross‑Request KV Cache Exposure in GLM‑5.3 Workers AI: A Deep Dive and SGLang Remediation
This article was originally published on FutureStack Introduction When a high‑throughput inference service leaks state between independent client calls, the breach is both a security risk and a performance nightmare. In late 2024 Cloudflare disclosed a cross‑request KV cache exposure in the GLM‑5.3 model running on Workers AI. The root cause was a subtle configuration mismatch that triggered a…
This article examines a security issue discovered in Cloudflare's GLM‑5.3 model running on Workers AI. The problem stems from a misconfiguration that caused cross‑request exposure of the KV cache used for token generation.
The model architecture consists of three isolated V8 environments, each maintaining a local KV cache for attention pages. These pages are stored with composite keys including a request ID, layer number and token index. The KV cache manager in SGLang pre‑allocates buffers for each request and maps them to slots in a buffer pool.
The bug occurs when the kv_isolation configuration is set to false, causing buffers to be recycled across requests. Without a guard, buffers could be reused before the KV pages are flushed, allowing stale token embeddings to be leaked between requests.
To remediate the issue, FutureStack implemented three key changes:
1) Embedding the request ID in all KV keys to enforce request‑scoped isolation
2) Introducing a generation fence counter that invalidates slots older than the current request
3) Setting a minimum TTL of 30 seconds for KV pages to guarantee eventual consistency before reuse.
The remediation code demonstrates how to safely write and read KV pages with the corrected key schema and generation fence. By enforcing request‑level isolation in KV keys and adding defensive mechanisms, the cross‑request exposure is mitigated and the system remains performant.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.