SGLang flaw lets attacker breach NEAR AI and steal user data

An attacker exploited a remote code execution flaw in SGLang, an open‑source inference engine, and ran code on one of NEAR AI’s inference servers last Sunday. NEAR AI said the intruder could also have seen requests being processed on that server that day, including requests in confidential mode, which runs inside a trusted execution environment (TEE) designed to keep data private even from the company.

The TEE does not protect against a vulnerability in the software running inside the environment, and SGLang runs inside the TEE, which enabled access to requests there. Access to the affected server has since been closed, but the attacker then moved further into NEAR AI’s systems.

NEAR AI confirmed the attacker downloaded account details for about 100 users in Private Chat, including names and email addresses, and, for some accounts, plan and balance information. The company found no evidence that stored Private Chat conversations or uploaded files were accessed. The intruder also reached 18 NEAR AI Agents on an older deployment that did not run inside the company’s TEE, taking data such as chat history, settings and logs from those agents.

Two NEAR AI Cloud API keys were exposed in logs and have been revoked. Following detection, NEAR AI revoked all active sessions and administrator credentials, rotated agent tokens, took Private Chat offline, and deployed a fix for the SGLang flaw across all inference servers. The company has reported the flaw to the SGLang project, and does not yet identify the affected SGLang versions or CVE. Affected users have been contacted directly via security@near[.]ai, with guidance for those specific accounts.