SGLang Flaw Let Attacker Into NEAR AI Servers, Exposing 100 Users

A remote code execution flaw in SGLang gave an attacker code execution on a NEAR AI inference server and access to the names and emails of roughly 100 users, according to an incident report NEAR AI published on November 9.

NEAR AI, the AI arm of the NEAR blockchain ecosystem, runs SGLang — the open-source inference engine — on its servers to serve large language models. The attacker exploited the vulnerability, landed on one inference server, then moved laterally into NEAR AI's infrastructure. From there they reached an internal system behind Private Chat, a product NEAR AI had already deprecated, and downloaded account details for about 100 users: names, email addresses, and plan and balance information for some of them.

The exposure didn't stop there. The attacker also pulled chat history, settings and logs from 18 agents running on a legacy NEAR AI Agents deployment — one that, critically, did not run inside NEAR AI's trusted execution environment. Two NEAR AI Cloud customers had API keys sitting in logs; those keys are now revoked. On November 8, the attacker could also have observed requests being processed on the compromised server, including confidential-mode requests, NEAR AI said.

There is a limit to the bad news. NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed.

What does this mean for confidential computing?

NEAR AI's core pitch is private inference: models running inside hardware enclaves. This incident exposed the boundary of that guarantee, and NEAR AI conceded the point. The enclave "does not protect against a vulnerability in the software running inside the environment," the company said, as The Block reported.

The company now says it will apply the same rigor to its inference software and surrounding services that it applies to the enclave itself — an acknowledgment that the security of confidential computing is only as strong as the code executing inside the protected environment.

How did NEAR AI respond?

The remediation list is long:

• Revoked all active sessions and administrative credentials
• Rotated agent tokens and other credentials
• Took Private Chat offline entirely
• Deployed an SGLang fix across its inference servers
• Paused and then restored NEAR AI Cloud
• Contacted affected users directly

Both exposed API keys have been revoked, NEAR AI said.

Are other SGLang deployments at risk?

That's the open question, and NEAR AI hasn't answered it. The company did not name a CVE identifier or the affected SGLang version, saying only that it reported the bug to the SGLang project. The SGLang project's GitHub page lists no published security advisories. Any other deployment running the vulnerable code could face the same attack path, and right now nobody outside the two parties knows which versions are affected.

SGLang's security record this year makes that gap more troubling. In July, CERT/CC disclosed six vulnerabilities in the project, including unauthenticated remote code execution through pickle deserialization. At publication, the maintainers had not provided patches, and CERT/CC's advice was blunt: keep SGLang servers off untrusted networks.

For now, NEAR AI has patched its fleet and rotated its credentials. But until SGLang publishes an advisory, every operator running the engine faces the same calculation NEAR AI just lost: an inference stack is only as secure as its least-audited dependency.