NEAR AI: SGLang code-execution flaw used to breach an inference server (reported 2026-11-09); no CVE, no SGLang advisory or fixed version named

View raw markdownEdit on GitHub ↗

TL;DR

NEAR AI reported on 2026-11-09 that an intruder used a remote code execution flaw in SGLang, the open-source inference engine, to run code on one of its inference servers and move into internal systems. Account details of about 100 Private Chat users were downloaded, 18 agents on a legacy deployment were accessed, and two customers' NEAR AI Cloud API keys were exposed in logs. NEAR AI says it fixed the flaw on its servers and reported it to the SGLang project. It names no CVE and no SGLang version. The SGLang repository's advisory tab showed no published advisories on 2026-11-11. If you run SGLang yourself, you cannot yet confirm a fix by version, so keep the server off untrusted networks.

What happened

NEAR AI's report (2026-11-09). An intruder exploited "a remote code execution flaw in SGLang", gained code execution on one inference server, and from there reached internal infrastructure. The report gives one date: on 2026-11-08 the intruder "could also have observed user requests being processed on the accessed server", including confidential-mode requests. It does not say when the intrusion began or when it was detected.

What Count and content, per NEAR AI
Private Chat users about 100 accounts: email addresses and names, and for some accounts plan and balance information
Private Chat content "We have found no indication that stored Private Chat conversation or uploaded files were accessed."
NEAR AI Agents, legacy deployment 18 agents: chat history, settings and logs. This deployment did not run inside the trusted execution environment.
NEAR AI Cloud API keys 2 customers' keys exposed in logs, both revoked

NEAR AI says confidential computing "does not protect against a vulnerability in the software running inside the environment". It revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, deployed a fix on all inference servers, rotated the remaining credentials and completed a forensic review. The report says NEAR AI reported the flaw to the SGLang project. It contacted affected users from security@near.ai and the 18 agent owners individually.

What is not known. The report names no CVE, no affected SGLang version and no fixed version. The Hacker News (2026-11-10) says the same and adds two open questions: whether users whose requests passed through that server on 2026-11-08 were among those contacted, and whether the server handled chats from Brave's Leo assistant, which a Brave post says runs a model inside a NEAR AI trusted execution environment. This sweep did not open the Brave post or NEAR AI's follow-up on X.

The upstream side. github.com/sgl-project/sglang/security/advisories, read 2026-11-11, says "There aren't any published security advisories." This corpus already tracks SGLang code-execution ids, including one the reporter says is unfixed, in the SGLang July to October CVE wave. Nothing NEAR AI published links its incident to any of those ids, and this file does not make that link. The other SGLang incident in this corpus, the Workers AI cross-request exposure, is a different mechanism.

Why contained. The vendor says the intruder's access is closed, the fix is deployed on its servers and the forensic review is complete. The flaw itself has no public identity, so for self-hosted SGLang this is an exploited, unidentified bug.

Am I affected?

  1. NEAR AI customers. Look for mail from security@near.ai. NEAR AI says it contacted users whose data or agents were confirmed accessed. If you sent confidential-mode requests on 2026-11-08, NEAR AI's wording is that they could have been observed on the one server. It has not said how to tell which server handled a request.
  2. NEAR AI Cloud API keys. If a key of yours was ever written into an agent's logs or settings, treat it as exposed whether or not you were contacted.
  3. Self-hosted SGLang. pip show sglang, or the image tag of your serving container. Then check exposure: which interfaces the server binds, and whether anything untrusted can reach its HTTP API or its internal ports.

If you are affected

  • NEAR AI users: follow the account-specific steps in the notice, rotate any NEAR AI Cloud API key that predates 2026-11-09, and treat mail that mentions your account or balance with suspicion. NEAR AI warns about this.
  • Agent owners on the legacy deployment: treat chat history, settings and logs as read. Rotate any credential that appeared in them. Rotating cloud credentials has the order.
  • SGLang operators: put the server behind an authenticating proxy or a private network now, and upgrade to the newest release. No source names the release that carries the fix, so an upgrade is hygiene, not confirmation. Watch the SGLang advisory tab and release notes for the fix NEAR AI reported.

Prevention

  • An enclave protects the host from seeing the workload. It does not protect the workload from its own bugs. Treat the inference engine as internet-facing software and patch it on that schedule.
  • Keep credentials out of logs. Two customers' keys were exposed because they were logged. Credential hygiene covers redaction and scoping.
  • Retire deprecated products fully. The intruder reached a deprecated chat product and a legacy agents deployment from the inference server.

Sources