NEAR AI Says a Remote Code Execution Flaw in SGLang Let an Attacker Into Its Infrastructure: About 100 Accounts, 18 Agents and Two API Keys. No CVE and No Fixed SGLang Version Is Published
If you run SGLang, the open-source server for serving language models, make sure it is not reachable from the internet and check whether your SGLang project has published a fix, because NEAR AI says an attacker used an SGLang code-execution flaw to get into its systems on November 8. NEAR AI has published its own incident report. Neither it nor The Hacker News gives a CVE, an affected version, a fixed version or the vulnerable endpoint, so nobody outside the project can yet tell you whether the version you run is safe.
What has been reported
The primary source is NEAR AI's incident report of November 9, read for us by an agent. The Hacker News report of November 10 matches it. We did not read an SGLang advisory, because neither source links one.
What happened, per NEAR AI: an attacker ran code on one of its inference servers through a flaw in SGLang, and from there reached "an internal system behind previously deprecated Private Chat." The Hacker News dates the intrusion to Sunday, November 8.
What was reached: account details for about 100 users, which for some accounts included email address, name, plan and balance; 18 agents on a legacy NEAR AI Agents deployment that did not run in a trusted execution environment, including chat history, settings and logs; and two NEAR AI Cloud customers' API keys that appeared in logs, both revoked.
Confidential-mode caveat: NEAR AI says that on November 8 the attacker could also have observed user requests being processed on the server they had reached, including requests running in confidential mode. It found no sign that stored Private Chat conversations or uploaded files were accessed. It does not say whether requests on that server can be tied to specific users.
Response: all active sessions and administrator credentials were revoked, all agent tokens replaced, Private Chat taken offline, the SGLang fix deployed on all its inference servers, remaining credentials rotated and a forensic review completed. NEAR AI warns users to be careful with unexpected messages that mention their account or balance.
Not published: the CVE, the SGLang versions affected and fixed, the vulnerable endpoint or parameter, any public exploit code, and any network indicators. NEAR AI says it reported the flaw to the SGLang project and does not say whether upstream has released a fix.
What it means
An inference server is a computer that runs untrusted input through a large program with broad access. One that executes attacker code is a foothold in whatever that server can reach: logs, keys, other users' requests. The point worth keeping from this incident is the part NEAR AI itself calls out: a legacy deployment outside the trusted environment, and keys sitting in logs. Neither needed a new flaw to be a problem.
What to do
If you run SGLang, do not expose its server to the internet. Put it behind authentication and a private network.
Check the SGLang project's security page and release notes for a fix, and update when one names the flaw. Until the project says which versions are affected, treat all versions as possibly affected.
Search your inference logs for API keys and tokens, and rotate any you find. Stop writing credentials to logs.
Retire old deployments that sit outside your main protections. NEAR AI's attacker went through one.
If you are a NEAR AI user, watch for messages that mention your account or balance, and treat any link in them as hostile. If you used an agent on its legacy deployment, assume its history was readable.
What is not known
Whether there is a CVE and which SGLang versions are affected. Whether the flaw is the same as an earlier SGLang bug or a new one. How the attacker reached the server. Who the attacker is. Whether others have been hit the same way. We read no statement from the SGLang project.
How we know, and how we checked
We read NEAR AI's incident report and The Hacker News's report through an agent, and did not test anything. A search of our corpus found no earlier post on this incident. Our edge check cannot see it: no vulnerable path is published. We add no indicators to our feed: none are published.
Sources
NEAR AI, "Security incident report: SGLang vulnerability," November 9, 2026. The Hacker News, "SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users," November 10, 2026.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments