NEAR AI reports SGLang RCE let attacker run code on an inference server
NEAR AI said an attacker exploited a remote code execution flaw in the open-source SGLang inference engine and ran code on one of its inference servers last Sunday.
Written by a model from the sources below. Verify against them.
- Vendor
- NEAR AI
- Product
- Cloud inference services
- Status
- Confirmed
- Disclosed
- Data taken
- About 100 records: Email addresses, Names, Tokens and keys
- The Hacker News: “An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.”
- Exploited vulnerability
Summary
The company said the attacker could also have seen requests processed on that server that day, including confidential-mode requests.
What to do
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it
For tokens and keys (two customers)Expect phishing that uses this breach; verify messages that mention it
For email addressesUpdate SGLang to a patched version if you run it in production
Rotate API keys and credentials that were processed by affected NEAR AI servers
Review agent and request logs for the affected period
Ask NEAR AI whether your data was among the requests that may have been visible
Rotate Near AI account passwords and any API keys or tokens tied to the account
Review account activity for unfamiliar logins or agent actions
Timeline
- Made public by The Hacker News
- First seen by cve.now
- Confirmed by NEAR AI
The Hacker News: “So far, the company has confirmed that the attacker downloaded account details for about 100 users there.”
1 day - Record last updated
What was taken
About 100 records, perThe Hacker News
| Taken | Per the source |
|---|---|
| Email addresses, Names | The Hacker News: “These are email addresses and names, and for some accounts, plan and balance information.” |
| Tokens and keys (two customers) | The Hacker News: “Two customers' NEAR AI Cloud API keys were exposed in logs.” |
Evidence 10
- Social
- SocialBluesky
“NEAR AI Cloud is back online after a security incident.”
- Social
- Social
- SocialBluesky
“An attacker exploited a remote code execution flaw in SGLang, the open-source inference engine, to break into NEAR AI on Nov 8, taking account details for about 100 users and data from 18 agents.”
Show all 10 sourcesShow fewer sources
- PressThe Hacker News
“An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.”
- SocialBluesky
“RCE flaw in SGLang compromised NEAR AI—user data, agents, API keys exposed.”
- SocialBluesky
“NEAR AI has confirmed a security breach involving its inference infrastructure, resulting in the exposure of user account details and AI agent data.”
- SocialBluesky
“NEAR AI Discloses Breach After Attackers Exploit Unpatched SGLang Vulnerability”
- PressDataBreaches.net
“Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers.”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the NEAR AI breach
Was NEAR AI breached?
Yes. NEAR AI says so: “So far, the company has confirmed that the attacker downloaded account details for about 100 users there.” (The Hacker News).
What data was exposed?
About 100 records. Email addresses, Names, Tokens and keys (two customers).
What should NEAR AI customers do?
Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Expect phishing that uses this breach; verify messages that mention it. Update SGLang to a patched version if you run it in production. Rotate API keys and credentials that were processed by affected NEAR AI servers. Review agent and request logs for the affected period. Ask NEAR AI whether your data was among the requests that may have been visible. Rotate Near AI account passwords and any API keys or tokens tied to the account. Review account activity for unfamiliar logins or agent actions.