NEAR AI Breached Through an SGLang RCE: No CVE, No Upstream Fix Yet

NEAR AI says an attacker used an unpatched remote code execution vulnerability in SGLang, the open-source inference engine on its servers, to break in on 8 November 2026. Its incident report, dated 9 November, lists account details for about 100 users, chat history, settings and logs from 18 agents on a legacy deployment, and two cloud customers' API keys found in logs. The attacker could also have watched requests being processed on the compromised server, including ones running in NEAR's confidential (TEE) mode. Four days later there is still no CVE, no SGLang advisory and no named fixed version, which leaves every other team running SGLang without a patch to install.

What happened

From NEAR AI's report and the index card on its blog, which gives the 8 November date:

• An attacker exploited "an unpatched SGLang vulnerability" to run code on one inference server.
• From that server they reached an internal system behind Private Chat, a product NEAR had already deprecated.
• They got access to 18 agents on a legacy NEAR AI Agents deployment that was not running in NEAR's TEE environment, and pulled chat history, settings and logs.
• Account details for roughly 100 users were exposed: email and name, plus plan and balance for some accounts. Two NEAR AI Cloud customers' API keys were in logs and have been revoked.
• NEAR says it has no indication that stored Private Chat conversations or uploaded files were accessed.

NEAR's response, per the same report: it revoked sessions and admin credentials, replaced agent tokens, took Private Chat offline, deployed "a fix for the SGLang vulnerability across all inference servers", rotated remaining credentials, finished a forensic review and restored cloud access. It also says it reported the flaw to the SGLang project. The Block and The Hacker News covered it on 10 November with the same figures.

The numbers

The part about the TEE

This is the detail I would put in front of anyone buying "confidential inference". NEAR runs inference inside a trusted execution environment, and its report is candid that the enclave "does not protect against a vulnerability in the software running inside the environment." A TEE protects the workload from the host and the cloud operator. It does nothing about a bug in the inference server that the TEE is faithfully protecting. Once the attacker had code execution inside SGLang, requests being processed there were visible to them, confidential mode or not.

That is not a criticism of TEEs. It is a reminder of what they are for. My confidential computing explainer has the longer version; the short one is that attestation proves you are running the code you meant to run, including its vulnerabilities.

What we do not know

NEAR names no CVE, no SGLang version, no endpoint and no detection date. SGLang's GitHub repository shows no published advisories and no security policy. So the following are open:

• Whether this is a new flaw or one of the six that CERT/CC published in VU#281278 on 30 July. Those include unauthenticated code execution through /load_lora_adapter_from_tensors and code execution through /update_weights_from_disk, both via unsafe pickle handling, and CERT said at the time that no patches were available. Nothing I have read links them to NEAR's incident, and I am not assuming it.
• Whether NEAR's "fix" is a code change, a configuration change or an endpoint block.
• Whether any SGLang release contains the fix. I downloaded the v0.5.23 wheel from PyPI and read its source: its SafeUnpickler now uses an exact allowlist of permitted globals, where CERT described a bypassable denylist. That suggests some hardening since July, but I cannot tell from code alone whether it closes CVE-2026-15969, and the project has said nothing.

What I ran: the v0.5.23 wheel's own auth function against each key configuration. With only --api-key set, that key also unlocks the weight-loading and LoRA-loading endpoints, and with no keys every endpoint is open. The full table and a reverse proxy config I tested are in the inference server lockdown guide.

What sceptics say

From NEAR's side, the blast radius was limited: one server, a deprecated product and a legacy agent deployment, about 100 users, and a fast, detailed disclosure. Many companies would have said less. And SGLang is not unusual. vLLM published a high-severity code execution chain through untrusted image input in GHSA-h3rc-j82p-2c3h on 20 October. Inference engines are big, fast-moving Python codebases built for researchers on trusted clusters, and putting one on the internet is the operator's choice.

The harder point is the disclosure gap. An exploited RCE in a widely used engine, a vendor saying it is fixed for them, and nothing public for anyone else is the worst position for operators: attackers know a working bug exists, and defenders cannot check for it.

What to do this week

• Get every SGLang HTTP port off the public internet. SGLang binds to 127.0.0.1 by default; check for --host 0.0.0.0 in your manifests and put an authenticating proxy in front.
• Set both keys. Use --api-key for clients and a separate --admin-api-key that no client ever holds, so the inference key cannot reach weight or adapter loading.
• Allowlist endpoints at the proxy: only /v1/chat/completions, /v1/completions, /v1/models and what you actually use.
• Isolate multi-node traffic. NCCL and the rendezvous port should only be reachable between engine pods.
• Rotate whatever the engine host could see: Hugging Face tokens, object storage credentials, and anything in logs.
• Watch for the advisory on the SGLang repository, and on the AI agent security incident log, where I have added this incident.

FAQ

What happened in the NEAR AI breach?

On 8 November 2026 an attacker exploited an unpatched remote code execution flaw in SGLang on one NEAR AI inference server, then reached an internal system behind its deprecated Private Chat product. About 100 users' account details, data from 18 legacy agents and two customers' API keys were exposed, per NEAR's 9 November report.

Is there a CVE or patch for the SGLang vulnerability?

Not as of 13 November 2026. NEAR AI has not named a CVE or SGLang version, and the SGLang repository has no published security advisories. NEAR says it deployed a fix on its own servers and reported the flaw to the project.

Does a TEE protect against inference server vulnerabilities?

No. A trusted execution environment protects a workload from the host and cloud operator, but a vulnerability in software running inside the enclave, such as the inference engine, can still be exploited. NEAR AI says this directly in its report.

Related: LLM Inference Engines 2026: vLLM vs SGLang vs TensorRT-LLM vs Dynamo, LiteLLM 1.107.0 Compromised: Credential Stealer Hit PyPI and Docker and AI Agent Security Incident Log.