--- id: "CMP-202611-z7pub5" page: "https://infrastack.ai/live/CMP-202611-z7pub5" kind: "campaign" aliases: [] title: "Attacker exploits an unpatched SGLang remote code execution flaw to break into NEAR AI's inference servers, stealing user and AI agent data and seeing confidential (TEE) requests" severity: "high" cvss: null epss: null exploited: true status: "open" category: "ai-tooling" products: [{"name": "SGLang", "fixed": [], "affected": "unknown", "ecosystem": "pypi"}, {"name": "NEAR AI Cloud", "note": "incident 8 Nov 2026", "fixed": [], "affected": "", "ecosystem": "saas"}, {"name": "NEAR AI Agents", "note": "18 legacy agents accessed", "fixed": [], "affected": "", "ecosystem": "saas"}, {"name": "NEAR AI", "note": "disclosed by the company", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["campaign", "early-warning"] not_affected_if: [] published_at: null first_seen_at: "2026-11-10T19:37:32+00:00" updated_at: "2026-11-10T19:45:12+00:00" sources: [{"source": "analyst", "url": "https://near.ai/blog/security-incident-report-sglang-vulnerability", "first_seen_at": "2026-11-10T19:37:32+00:00", "cites": ["https://near.ai/blog/security-incident-report-sglang-vulnerability"]}] exploit_sources: [] --- # Attacker exploits an unpatched SGLang remote code execution flaw to break into NEAR AI's inference servers, stealing user and AI agent data and seeing confidential (TEE) requests Link for people: https://infrastack.ai/live/CMP-202611-z7pub5 (this .md is for agents) On 8 Nov 2026 an attacker exploited a remote code execution vulnerability in SGLang, the open-source LLM inference engine, to run code on one of NEAR AI's inference servers and move into its infrastructure (NEAR AI incident report, 9 Nov). Confirmed: account details (email, name, for some plan and balance) of about 100 users taken from the deprecated Private Chat backend; chat history, settings and logs of 18 legacy NEAR AI Agents; two NEAR AI Cloud customers' API keys exposed in logs (revoked); requests being processed on that server on 8 Nov could have been seen, including confidential-mode requests, because the TEE does not protect against a flaw in the software running inside it. NEAR AI fixed its own servers and reported the bug to the SGLang project. The SGLang flaw has no CVE yet; affected SGLang versions and whether an upstream fix exists are unknown. Any internet-reachable SGLang server may be exposed to the same flaw. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - pypi:SGLang affected unknown fixed no fixed version listed - saas:NEAR AI Cloud affected range not listed fixed no fixed version listed - saas:NEAR AI Agents affected range not listed fixed no fixed version listed - vendor:NEAR AI affected range not listed fixed no fixed version listed ## Cause How the attacker got in: a known vulnerability left unpatched (unpatched-vuln). An attacker exploited a remote code execution vulnerability in SGLang, which NEAR AI ran on its inference server, to move into its infrastructure, and the users of that provider had their account details, chat history and API keys exposed. How it reached others: customers' data or keys went with it (third-party-breach). So it does not happen to you: Your board lists the advisories that are in range for your stack, with the fix version. Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach ## How to check - Do you run SGLang (pip package sglang) for model serving, and can untrusted users or the internet reach its HTTP/API port? Affected versions: unknown. - Look for unexpected child processes, shells or outbound connections from SGLang server processes, and unusual file reads of credentials or tokens on inference hosts, from 8 Nov 2026 onward. - NEAR AI users: affected users were contacted from security@near.ai; NEAR AI says those not contacted need not act. It is unknown whether people whose requests passed through the affected server on 8 Nov (including Brave Leo chats that run on NEAR AI's TEE) were contacted. - Indicators (IPs, payloads): unknown. ## Fix - Do not expose SGLang servers to the internet or untrusted networks; put them behind an authenticated gateway and restrict network access to the API port. - Watch the SGLang project (GitHub sgl-project/sglang) for a security release or advisory and upgrade as soon as one ships. - Keep secrets and API keys out of inference server environments and logs; rotate any credentials reachable from SGLang hosts if you see suspicious activity. - NEAR AI customers: treat unsolicited messages about your account or balance with caution, and rotate NEAR AI Cloud API keys if unsure. ## Timeline - 2026-11-09T00:00:00+00:00 confirmed by NEAR AI (blog) https://near.ai/blog/security-incident-report-sglang-vulnerability "NEAR AI recently identified and contained unauthorized access to part of its infrastructure." - 2026-11-10T19:37:32+00:00 analyst https://near.ai/blog/security-incident-report-sglang-vulnerability ## Documents - [describes] @TheHackersNews: 🚨 An attacker exploited an SGLang RCE flaw to breach NEAR AI. Data stolen from https://x.com/TheHackersNews/status/2120235277268685225 - [describes] NEAR AI Security Incident Report: SGLang Vulnerability https://near.ai/blog/security-incident-report-sglang-vulnerability --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_