SGLang Flaw Let an Attacker Breach NEAR AI's "Confidential" Inference Servers

NEAR AI said on 9 November 2026 that an unauthorized party exploited a remote-code-execution vulnerability in SGLang, the open-source inference engine running on its servers, to gain code execution on one of its inference servers. According to the company's own security incident report, the intrusion began on 8 November 2026 and reached account details for roughly 100 users, chat history and settings for 18 agents on a legacy deployment, and two Cloud customers' API keys that had been exposed in logs.

What NEAR AI Says Happened

NEAR AI's report says the attacker used the SGLang flaw to run code inside one inference server and from there reached an internal system tied to Private Chat, a feature the company had already deprecated. From that system, the attacker could access account details — email addresses and names, and for some accounts plan and balance information — for about 100 users, and chat history, settings and logs from 18 agents running on an older NEAR AI Agents deployment that was not inside the company's confidential computing environment. The report states there is no indication that stored Private Chat conversations or uploaded files were accessed.

The company says the attacker could also have observed requests being processed on the compromised server on 8 November 2026, "including requests running in confidential mode," and that two Cloud customers' API keys were found exposed in logs and have since been revoked.

Confidential Computing Didn't Stop a Software Bug

NEAR AI markets its Cloud service around confidential inference, running workloads inside trusted execution environments (TEEs) so that, in principle, even the server operator cannot see what is being processed. Its own report draws the line clearly: "Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment." The SGLang flaw sat inside that environment, in the inference software itself rather than in the enclave boundary, which is why the TEE did not stop the attacker from reaching requests and data on the affected server, according to a research note from the Cloud Security Alliance's AI Safety Initiative.

SGLang has had a recurring pattern of critical remote-code-execution disclosures through 2026. In one earlier case unrelated to the NEAR AI incident, CERT/CC published VU#915947 on 20 April 2026, describing how SGLang's reranking endpoint could be made to run arbitrary Python code when a malicious GGUF model file carried a poisoned chat template, because the server rendered templates with an unsandboxed Jinja2 environment. CERT/CC's advisory states it received no statement or patch from the vendor during coordination. NEAR AI has not said whether the flaw exploited against its servers matches that bug or any other previously disclosed SGLang vulnerability.

What's Still Unknown

NEAR AI's report does not name a CVE number for the vulnerability that was exploited, does not say which SGLang version was affected, and does not say whether the SGLang project has released a fix. The company says only that it has deployed its own fix across its inference servers and reported the vulnerability to the SGLang project. The Hacker News, reporting independently on the disclosure, notes the same gap: no CVE identifier, no named affected versions, and no confirmation of an upstream patch.

The Cloud Security Alliance's AI Safety Initiative recommends that organisations running SGLang rotate any credentials that may have passed through affected servers, patch their SGLang deployments, separate control-plane endpoints from user-facing inference traffic, apply egress filtering, run inference services with least privilege, redact credentials from logs, and decommission legacy systems such as the deprecated Private Chat feature that was part of the attack path in this case.

Why It Matters for Researchers and Developers

SGLang is the kind of infrastructure component that sits underneath many research and production LLM deployments rather than in front of them, so a flaw in it can expose data regardless of which model is being served or how carefully the application layer was built. Anyone self-hosting SGLang, or relying on a cloud provider that uses it, inherits its vulnerability history as part of their own security posture — including the open questions NEAR AI has left unanswered about which flaw was used and whether it has been fixed upstream.

NEAR AI says it has rewritten part of its internal security process as a result: "We are now treating the inference software and the services around the enclave with the same rigor as the enclave itself." For students and engineers building on confidential-computing claims, the incident is a concrete illustration of a distinction that is easy to miss in marketing language: a TEE can hide data from the cloud operator while doing nothing to stop an attacker who finds a bug in the application running inside it.