---
id: "TECH-202610-sglang-prefill-decode-disaggregation-can-leak-other-users-pr"
kind: "technique"
aliases: []
title: "SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "sglang", "fixed": [], "affected": "unknown (builds without PRs #36988/#38935, prefill/decode disaggregation mode)", "ecosystem": "pypi"}]
ecosystems: []
tags: ["early-warning", "llm-serving", "self-hosted", "sglang", "technique", "tenant-isolation"]
not_affected_if: []
published_at: "2026-10-26T00:00:00+00:00"
first_seen_at: "2026-10-26T22:47:05+00:00"
updated_at: "2026-10-26T22:47:05+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-26T22:47:05+00:00"}]
---

# SGLang prefill/decode disaggregation can leak other users' prompts and outputs when a prompt exceeds the prefill KV cache pool

In SGLang's disaggregated prefill/decode mode, a request too long for the prefill KV cache pool is marked rejected and swapped for a one-token placeholder, but it is not aborted. Prefill still sends KV for the placeholder, and decode treats the transfer as complete. Decode then generates over stale KV pages that still hold earlier requests' data, so the response can contain other users' content. Cloudflare disclosed it with SGLang on 2026-10-26: from 2026-08-27 to 2026-09-09, 155 Workers AI GLM-5.3 responses carried other customers' data. Those deployments served a 1,048,576-token context with a 681,280-token prefill pool. The bug was reported by Gadi Evron (Knostic). Anyone self-hosting multi-tenant SGLang with PD disaggregation is at risk if the advertised context length is larger than the prefill KV pool, or if the scheduler can reject requests some other way. Cloudflare saw no deliberate exploitation. No CVE known yet. Cloudflare has already fixed Workers AI.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:sglang affected unknown (builds without PRs #36988/#38935, prefill/decode disaggregation mode) fixed ?

## How to check

- Check whether SGLang runs with prefill/decode disaggregation (Mooncake, NIXL or MORI transfer backend)
- Compare the configured context length with the prefill KV cache pool size in the prefill server startup logs (max total tokens). Exposure exists if the context is larger than the pool
- Check whether your SGLang build includes PRs #36988 and #38935 (and proposed #38704). Which release first ships them is unknown
- Look for responses to very long prompts that contain content unrelated to the prompt

## Fix

- Size the prefill KV pool to at least the advertised context length, or lower the context length/max input to fit the pool. Cloudflare says this alone stops the bug from triggering
- Upgrade SGLang to a build that includes #36988 and #38935, which reject over-length requests before any KV transfer (fixed release version unknown)
- Until then, avoid sharing one PD-disaggregated deployment across tenants with different trust levels

## Timeline

- 2026-10-26T22:47:05+00:00 analyst

## Documents

- [describes] @Cloudflare: A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that e https://x.com/Cloudflare/status/2114848043853873286
- [describes] Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang https://blog.cloudflare.com/kv-cache-exposure-remediation/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_