How do I check whether I am affected by TECH-202610-sglang-prefill-decode-disaggregation-can-leak-other-users-pr?

- Check whether SGLang runs with prefill/decode disaggregation (Mooncake, NIXL or MORI transfer backend) - Compare the configured context length with the prefill KV cache pool size in the prefill server startup logs (max total tokens). Exposure exists if the context is larger than the pool - Check whether your SGLang build includes PRs #36988 and #38935 (and proposed #38704). Which release first ships them is unknown - Look for responses to very long prompts that contain content unrelated to the prompt

Live › technique › TECH-202610-sglang-prefill-decode-disaggregation-can-leak-other-users-pr

Go to dashboard

medium⚡ Early warning · no CVE yetAI agents & MCP

SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool

Q: What is the fix for TECH-202610-sglang-prefill-decode-disaggregation-can-leak-other-users-pr?

- Size the prefill KV pool to at least the advertised context length, or lower the context length/max input to fit the pool. Cloudflare says this alone stops the bug from triggering - Upgrade SGLang to a build that includes #36988 and #38935, which reject over-length requests before any KV transfer (fixed release version unknown) - Until then, avoid sharing one PD-disaggregated deployment across tenants with different trust levels

In SGLang's disaggregated prefill/decode mode, a request too long for the prefill KV cache pool is marked rejected and swapped for a one-token placeholder, but it is not aborted. Prefill still sends KV for the placeholder, and decode treats the transfer as complete. Decode then generates over stale KV pages that still hold earlier requests' data, so the response can contain other users' content. Cloudflare disclosed it with SGLang on 2026-10-26: from 2026-08-27 to 2026-09-09, 155 Workers AI GLM-5.3 responses carried other customers' data. Those deployments served a 1,048,576-token context with a 681,280-token prefill pool. The bug was reported by Gadi Evron (Knostic). Anyone self-hosting multi-tenant SGLang with PD disaggregation is at risk if the advertised context length is larger than the prefill KV pool, or if the scheduler can reject requests some other way. Cloudflare saw no deliberate exploitation. No CVE known yet. Cloudflare has already fixed Workers AI.

Summary written from the sources below. Check the originals before acting.

Known so far

4/6

medium

no CVSS yet; severity from the sources

known so far4 of 6

missing: primary source, exploitation

First public: Oct 26, 2026 UTC
Last modified: Oct 26, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-26 22:47 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
sglang	pypi	unknown (builds without PRs #36988/#38935, prefill/decode disaggregation mode)	–

Who cares: early-warning, llm-serving, self-hosted, sglang, technique, tenant-isolation
Not affected if: –

How to check

Check whether SGLang runs with prefill/decode disaggregation (Mooncake, NIXL or MORI transfer backend)
Compare the configured context length with the prefill KV cache pool size in the prefill server startup logs (max total tokens). Exposure exists if the context is larger than the pool
Check whether your SGLang build includes PRs #36988 and #38935 (and proposed #38704). Which release first ships them is unknown
Look for responses to very long prompts that contain content unrelated to the prompt

The fix

Size the prefill KV pool to at least the advertised context length, or lower the context length/max input to fit the pool. Cloudflare says this alone stops the bug from triggering

Know the next one before it finds you.

Add to Slack

SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool

Summary written from the sources below. Check the originals before acting.

Product

Ecosystem

Affected

Fixed in

sglang

pypi

unknown (builds without PRs #36988/#38935, prefill/decode disaggregation mode)

–

SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool

Who is affected

How to check

The fix

Know the next one before it finds you.

SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

Sources