SGLang RCE Exploit Breaches NEAR AI Inference Servers, Exposing Data from 18 Agents and 100 Users
An attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to compromise one of NEAR AI's inference servers last Sunday. The intrusion allowed access to requests processed that day, including those handled in confidential mode inside a trusted execution environment. Although the TEE was intended to protect privacy, the flaw in SGLang running inside it enabled the attacker to reach sensitive data. The intruder then moved laterally to an internal system behind the deprecated Private Chat product, downloading account details for roughly 100 users. Eighteen AI agents on an older NEAR AI Agents deployment outside the TEE were also compromised, resulting in the theft of chat histories, settings, and logs. Two NEAR AI Cloud API keys were exposed in logs and subsequently revoked. NEAR AI has since revoked sessions, replaced tokens, deployed a SGLang fix across servers, and completed forensic review while notifying affected users.
The Hacker NewsNov 10, 2026Translated from English