Newshot SGLang RCE Vulnerability Breaches NEAR AI, Data Stolen From 18 Agents and Nearly 100 Users
SGLang RCE Vulnerability Exploited, Attackers Breach TEE Protections to Compromise System
Last Sunday, attackers exploited a remote code execution (RCE) vulnerability in the open-source inference engine SGLang to execute malicious code on an inference server at NEAR AI.
NEAR AI disclosed earlier this week that the attackers may have accessed all requests being processed on that server that day, including requests submitted in confidential mode. Confidential mode processes requests based on a trusted execution environment (TEE), and is designed so that even NEAR AI itself cannot view request contents, ensuring data privacy.
NEAR AI said: "A trusted execution environment cannot protect against vulnerabilities in the software running inside the environment itself." SGLang itself runs inside the TEE, so the attackers were able to access the requests processed within it.
NEAR AI has now cut off this access path for the attackers, but before that, the attackers had already penetrated further into NEAR AI's internal systems.
Multiple Internal Systems Accessed, User and Agent Data Stolen
The attackers penetrated the backend internal systems of the deprecated product Private Chat. It has been confirmed that the attackers downloaded account information for about 100 users in that system, including email addresses and names; some accounts also included plan and balance information.
No traces have been found that the attackers accessed chat records or user-uploaded files stored by Private Chat.
The attackers also accessed 18 AI Agents in an old deployment environment of NEAR AI Agents; that old deployment did not run inside NEAR AI's TEE. The attackers stole data including chat records, configuration information, and logs from these Agents.
Logs exposed the NEAR AI Cloud API keys of two customers, and NEAR AI has revoked both keys.
Emergency Response Completed, Some Scope of Impact Not Yet Disclosed
According to the incident report published by NEAR AI, after discovering the attack, NEAR AI revoked all active sessions and administrator credentials, replaced all Agent tokens, and took Private Chat offline; at the same time, it deployed the SGLang vulnerability patch on all inference servers, rotated all remaining credentials, and completed a comprehensive forensic analysis.
NEAR AI has now restored access to the NEAR AI Cloud service. NEAR AI has reported the vulnerability to the SGLang project, but has not yet published the CVE ID of the vulnerability or the affected SGLang versions, nor stated whether the SGLang project has released a fix.
NEAR AI has contacted all corresponding users of accounts or Agents confirmed to have been accessed. Affected users will receive an email from [email protected] informing them of the response measures they need to take. As a precaution, NEAR AI reminds users to be wary of unsolicited messages related to accounts or balances.
In a follow-up announcement released yesterday, NEAR AI said that users who have not received a notification do not need to take any action. However, it has not stated whether users whose requests were processed by the affected server last Sunday are within the notified group.
Browser vendor Brave mentioned in a technical article published on October 15 that when its Leo assistant uses the GLM 5.3 Flash model, the chat service runs in a TEE environment operated by NEAR AI. NEAR AI has not yet stated whether the server attacked this time processed any of those chat requests.
SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users