# SZB-65bc1bddc8: NEAR AI reports SGLang RCE let attacker run code on an inference server

NEAR AI said an attacker exploited a remote code execution flaw in the open-source SGLang inference engine and ran code on one of its inference servers last Sunday.

- Type: Breach
- Status: Confirmed
- Vendor: NEAR AI
- Product: Cloud inference services
- Disclosed: 2026-11-10 03:03 UTC
- Data taken: About 100 records: Email addresses, Names, Tokens and keys
- Way in: Exploited vulnerability (The Hacker News: “An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.”, [source](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html))
- Sources: 10 distinct
- First seen by cve.now: 2026-11-10 03:04 UTC · Updated: 2026-11-11 00:10 UTC

Written by a model from the sources below. Verify against them.

## Summary

The company said the attacker could also have seen requests processed on that server that day, including confidential-mode requests.

## What to do

- Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it · For tokens and keys (two customers)
- Expect phishing that uses this breach; verify messages that mention it · For email addresses
- Update SGLang to a patched version if you run it in production
- Rotate API keys and credentials that were processed by affected NEAR AI servers
- Review agent and request logs for the affected period
- Ask NEAR AI whether your data was among the requests that may have been visible
- Rotate Near AI account passwords and any API keys or tokens tied to the account
- Review account activity for unfamiliar logins or agent actions

## Timeline

- 2026-11-10 03:03 UTC: Made public by The Hacker News
- 2026-11-10 03:04 UTC: First seen by cve.now
- 2026-11-10 19:19 UTC: Confirmed by NEAR AI. The Hacker News: “So far, the company has confirmed that the attacker downloaded account details for about 100 users there.” ([source](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html))
- 2026-11-11 00:10 UTC: Record last updated

## What was taken

About 100 records, per [The Hacker News](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html).

- Email addresses, Names: [The Hacker News](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html): “These are email addresses and names, and for some accounts, plan and balance information.”
- Tokens and keys (two customers): [The Hacker News](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html): “Two customers' NEAR AI Cloud API keys were exposed in logs.”

## Evidence (10 sources)

- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mzwhdgyyzc26): “NEAR AI halts cloud inference services due to an internal system breach.” (+4 more: [Bluesky](https://bsky.app/profile/blockchainreport.bsky.social/post/3mzwijiwtyu2h), [Bluesky](https://bsky.app/profile/decrypt.co/post/3mzyb6jsj2m2w), [Bluesky](https://bsky.app/profile/coinlab.bsky.social/post/3mzybkj3fuf2d), [Bluesky](https://bsky.app/profile/growmybag.tv/post/3mzynrm4uab2b))
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mzwj2k7mel2s): “NEAR AI Cloud is back online after a security incident.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzxadtg3lr25): “NEAR AI has remediated a security incident involving the SGLang inference engine that exposed account details for approximately 100 users.” (+1 more: [Bluesky](https://bsky.app/profile/bitnxtofficial.bsky.social/post/3mzxcnltsi42d))
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/aisecguru.bsky.social/post/3mzxgrttzti2c): “NEAR AI: an attacker used an RCE flaw in the SGLang inference engine to take over one server, pull account details for ~100 users and read 18 legacy agents' chats and logs.” (+1 more: [Bluesky](https://bsky.app/profile/abijita.bsky.social/post/3mzxq6aa6qf2d))
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/thefosswire.bsky.social/post/3mzxn7n4nws2s): “An attacker exploited a remote code execution flaw in SGLang, the open-source inference engine, to break into NEAR AI on Nov 8, taking account details for about 100 users and data from 18 agents.”
- 2026-11-10 · Press · [The Hacker News](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html): “An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI's inference servers last Sunday.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/thedailytechfeed.com/post/3mzy6giyscp27): “RCE flaw in SGLang compromised NEAR AI—user data, agents, API keys exposed.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/gazewires.bsky.social/post/3mzy7huzxtv26): “NEAR AI has confirmed a security breach involving its inference infrastructure, resulting in the exposure of user account details and AI agent data.”
- 2026-11-10 · Social · [Bluesky](https://bsky.app/profile/basisdesknews.bsky.social/post/3mzybmeb2e42g): “NEAR AI Discloses Breach After Attackers Exploit Unpatched SGLang Vulnerability”
- 2026-11-10 · Press · [DataBreaches.net](https://databreaches.net/2026/11/10/near-ai-breach-exposes-user-details-and-data-from-18-ai-agents/): “Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-65bc1bddc8&body=https%3A%2F%2Fcve.now%2FSZB-65bc1bddc8%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the NEAR AI breach

### Was NEAR AI breached?

Yes. NEAR AI says so: “So far, the company has confirmed that the attacker downloaded account details for about 100 users there.” (The Hacker News).

Source: https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html

### What data was exposed?

About 100 records. Email addresses, Names, Tokens and keys (two customers).

### What should NEAR AI customers do?

Rotate API keys and tokens you gave it, and review the OAuth apps and integrations connected to it. Expect phishing that uses this breach; verify messages that mention it. Update SGLang to a patched version if you run it in production. Rotate API keys and credentials that were processed by affected NEAR AI servers. Review agent and request logs for the affected period. Ask NEAR AI whether your data was among the requests that may have been visible. Rotate Near AI account passwords and any API keys or tokens tied to the account. Review account activity for unfamiliar logins or agent actions.

## Related

- Started as early warning SZB-65bc1bddc8, first seen 2026-11-10 03:04 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-65bc1bddc8
Site guide for agents: https://cve.now/llms.txt