{"id":"CMP-202611-z7pub5","kind":"campaign","aliases":[],"related":[],"title":"Attacker exploits an unpatched SGLang remote code execution flaw to break into NEAR AI's inference servers, stealing user and AI agent data and seeing confidential (TEE) requests","description":null,"summary":"On 8 Nov 2026 an attacker exploited a remote code execution vulnerability in SGLang, the open-source LLM inference engine, to run code on one of NEAR AI's inference servers and move into its infrastructure (NEAR AI incident report, 9 Nov). Confirmed: account details (email, name, for some plan and balance) of about 100 users taken from the deprecated Private Chat backend; chat history, settings and logs of 18 legacy NEAR AI Agents; two NEAR AI Cloud customers' API keys exposed in logs (revoked); requests being processed on that server on 8 Nov could have been seen, including confidential-mode requests, because the TEE does not protect against a flaw in the software running inside it. NEAR AI fixed its own servers and reported the bug to the SGLang project. The SGLang flaw has no CVE yet; affected SGLang versions and whether an upstream fix exists are unknown. Any internet-reachable SGLang server may be exposed to the same flaw.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-10T19:37:32+00:00","products":[{"name":"SGLang","fixed":[],"affected":"unknown","ecosystem":"pypi"},{"name":"NEAR AI Cloud","note":"incident 8 Nov 2026","fixed":[],"affected":"","ecosystem":"saas"},{"name":"NEAR AI Agents","note":"18 legacy agents accessed","fixed":[],"affected":"","ecosystem":"saas"},{"name":"NEAR AI","note":"disclosed by the company","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"- Do you run SGLang (pip package sglang) for model serving, and can untrusted users or the internet reach its HTTP/API port? Affected versions: unknown.\n- Look for unexpected child processes, shells or outbound connections from SGLang server processes, and unusual file reads of credentials or tokens on inference hosts, from 8 Nov 2026 onward.\n- NEAR AI users: affected users were contacted from security@near.ai; NEAR AI says those not contacted need not act. It is unknown whether people whose requests passed through the affected server on 8 Nov (including Brave Leo chats that run on NEAR AI's TEE) were contacted.\n- Indicators (IPs, payloads): unknown.","fix":"- Do not expose SGLang servers to the internet or untrusted networks; put them behind an authenticated gateway and restrict network access to the API port.\n- Watch the SGLang project (GitHub sgl-project/sglang) for a security release or advisory and upgrade as soon as one ships.\n- Keep secrets and API keys out of inference server environments and logs; rotate any credentials reachable from SGLang hosts if you see suspicious activity.\n- NEAR AI customers: treat unsolicited messages about your account or balance with caution, and rotate NEAR AI Cloud API keys if unsure.","status":"open","published_at":null,"first_seen_at":"2026-11-10T19:37:32+00:00","triaged_at":"2026-11-10T19:37:32+00:00","updated_at":"2026-11-10T19:45:12+00:00","category":"ai-tooling","confidence":null,"triage":{"cause":{"at":"2026-11-10T19:50:18Z","path":"third-party-breach","entry":"unpatched-vuln","reason":"An attacker exploited a remote code execution vulnerability in SGLang, which NEAR AI ran on its inference server, to move into its infrastructure, and the users of that provider had their account details, chat history and API keys exposed.","history":[{"at":"2026-11-10T19:40:18Z","path":"third-party-breach","entry":"unpatched-vuln","confidence":0.85}],"confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-202611':30A '100':100B '18':115B '2026':48B '8':46B,138B '9':86B 'account':89B 'affect':185B 'agent':22A,119B 'agents':38A 'ai':14A,21A,34A,37A,40A,73B,83B,118B,122B,165B 'api':125B 'attack':1A,50B 'backend':108B 'balanc':97B 'break':11A 'bug':173B 'campaign':41B 'chat':107B,109B 'cloud':35A,123B 'cmp':29A 'code':7A,54B,68B 'confidenti':26A,146B 'confidential-mod':145B 'confirm':88B 'could':140B 'custom':124B 'cve':183B 'data':23A 'deprec':105B 'detail':90B 'earli':43B 'early-warn':42B 'email':91B 'engin':65B 'execut':8A,55B 'exist':193B 'exploit':2A,51B 'expos':127B,204B 'fix':166B,192B 'flaw':9A,157B,180B,208B 'histori':110B 'incid':84B 'includ':144B 'infer':16A,64B,75B 'infrastructur':81B 'insid':162B 'internet':198B 'internet-reach':197B 'key':126B 'legaci':116B 'llm':63B 'log':113B,129B 'may':202B 'mode':147B 'move':78B 'name':92B 'near':13A,33A,36A,39A,72B,82B,117B,121B,164B 'nov':47B,87B,139B 'one':70B 'open':61B 'open-sourc':60B 'plan':95B 'privat':106B 'process':133B 'project':177B 'protect':154B 'reachabl':199B 'remot':6A,53B 'report':85B,171B 'request':28A,131B,148B 'revok':130B 'run':67B,161B 'see':25A 'seen':143B 'server':17A,76B,136B,169B,201B 'set':111B 'sglang':5A,32A,58B,176B,179B,186B,200B 'softwar':160B 'sourc':62B 'steal':18A 'taken':102B 'tee':27A,151B 'two':120B 'unknown':195B 'unpatch':4A 'upstream':191B 'user':19A,101B 'version':187B 'vulner':56B 'warn':44B 'whether':189B 'yet':184B 'z7pub5':31A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["ai","aiagents","aicloud","nearai","nearaiagents","nearaicloud","sglang"],"ptokens":["agents","ai","cloud","near","sglang"],"labels":["aitooling","campaign","earlywarning","high","vendor"],"campaign_type":"breach","search_a":"'-202611':30A 'agent':22A 'agents':38A 'ai':14A,21A,34A,37A,40A 'attack':1A 'break':11A 'cloud':35A 'cmp':29A 'code':7A 'confidenti':26A 'data':23A 'execut':8A 'exploit':2A 'flaw':9A 'infer':16A 'near':13A,33A,36A,39A 'remot':6A 'request':28A 'see':25A 'server':17A 'sglang':5A,32A 'steal':18A 'tee':27A 'unpatch':4A 'user':19A 'z7pub5':31A","search_b":"'100':100B '18':115B '2026':48B '8':46B,138B '9':86B 'account':89B 'affect':185B 'agent':119B 'ai':73B,83B,118B,122B,165B 'api':125B 'attack':50B 'backend':108B 'balanc':97B 'bug':173B 'campaign':41B 'chat':107B,109B 'cloud':123B 'code':54B,68B 'confidenti':146B 'confidential-mod':145B 'confirm':88B 'could':140B 'custom':124B 'cve':183B 'deprec':105B 'detail':90B 'earli':43B 'early-warn':42B 'email':91B 'engin':65B 'execut':55B 'exist':193B 'exploit':51B 'expos':127B,204B 'fix':166B,192B 'flaw':157B,180B,208B 'histori':110B 'incid':84B 'includ':144B 'infer':64B,75B 'infrastructur':81B 'insid':162B 'internet':198B 'internet-reach':197B 'key':126B 'legaci':116B 'llm':63B 'log':113B,129B 'may':202B 'mode':147B 'move':78B 'name':92B 'near':72B,82B,117B,121B,164B 'nov':47B,87B,139B 'one':70B 'open':61B 'open-sourc':60B 'plan':95B 'privat':106B 'process':133B 'project':177B 'protect':154B 'reachabl':199B 'remot':53B 'report':85B,171B 'request':131B,148B 'revok':130B 'run':67B,161B 'seen':143B 'server':76B,136B,169B,201B 'set':111B 'sglang':58B,176B,179B,186B,200B 'softwar':160B 'sourc':62B 'taken':102B 'tee':151B 'two':120B 'unknown':195B 'upstream':191B 'user':101B 'version':187B 'vulner':56B 'warn':44B 'whether':189B 'yet':184B","search_c":"","cause_entry":"unpatched-vuln","cause_path":"third-party-breach","disclosures_checked_at":"2026-11-10T19:55:44+00:00","first_public_at":"2026-11-09T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-z7pub5","url":"https://near.ai/blog/security-incident-report-sglang-vulnerability","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-10T19:37:32+00:00","fetched_at":"2026-11-10T19:37:32+00:00","note":null,"cites":["https://near.ai/blog/security-incident-report-sglang-vulnerability"]}],"documents":[{"id":117464,"url":"https://x.com/TheHackersNews/status/2120235277268685225","title":"@TheHackersNews: 🚨 An attacker exploited an SGLang RCE flaw to breach NEAR AI.\n\nData stolen from ","kind":"post","source":"x","publisher":null,"text":"🚨 An attacker exploited an SGLang RCE flaw to breach NEAR AI.\n\nData stolen from 18 AI agents and about 100 user accounts. Confidential AI requests processed on one server may also have been visible to the attacker.\n\nWhat NEAR AI confirmed about the breach ↓ https://t.co/scaiuPctvW\n\nlikes 29 reposts 5","published_at":"2026-11-10T19:20:56+00:00","relation":"describes","confidence":null,"note":null},{"id":117596,"url":"https://near.ai/blog/security-incident-report-sglang-vulnerability","title":"NEAR AI Security Incident Report: SGLang Vulnerability","kind":"vendor","source":"analyst","publisher":null,"text":"NEAR AI: attacker exploited a remote code execution vulnerability in SGLang on one inference server (Nov 8, 2026), moved into infrastructure, downloaded account details (email, name, some plan/balance) of ~100 users from deprecated Private Chat backend, accessed 18 legacy NEAR AI Agents (chat history, settings, logs), could observe requests in processing on that server including confidential (TEE) mode. Two Cloud customers' API keys exposed in logs, revoked. Fix deployed across inference servers; vulnerability reported to SGLang project. Affected users contacted from security@near.ai.","published_at":"2026-11-09T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[{"company":"NEAR AI","domain":"near.ai","url":"https://near.ai/blog/security-incident-report-sglang-vulnerability","kind":"blog","published_at":"2026-11-09T00:00:00+00:00","quote":"NEAR AI recently identified and contained unauthorized access to part of its infrastructure.","confidence":0.9700000286102295,"source":"model","created_at":"2026-11-10T19:45:12+00:00","entry":"unpatched-vuln"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}