Skip to content
AI Security Wire

Published

- 4 min read

By

NEAR AI: SGLang RCE Could Have Exposed Requests Inside a Confidential TEE

SGLang NEAR AI confidential computing TEE inference engines remote code execution AI infrastructure
img of NEAR AI: SGLang RCE Could Have Exposed Requests Inside a Confidential TEE

NEAR AI says an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine, on 8 November to run code on one of its inference servers. The company published an incident report on 9 November. The headline detail is where the flaw sat: inside the confidential computing environment meant to keep requests private even from NEAR AI itself.

What NEAR AI reports

According to the report, the attacker gained code execution on one inference server and moved from there into the wider infrastructure. NEAR AI has confirmed the following:

  • Account details for approximately 100 users were downloaded from an internal system behind Private Chat, a product the company had already deprecated. The data was email addresses, names and, for some accounts, plan and balance information.
  • 18 agents on a legacy NEAR AI Agents deployment, which did not run in the company’s TEE, were accessed. The data retrieved included chat history, settings and logs.
  • Two NEAR AI Cloud customers had API keys exposed in logs. Both keys have been revoked.
  • On 8 November the attacker could also have observed user requests being processed on the accessed server, including requests running in confidential mode.

NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed. It has not said how many requests passed through the affected server, or whether the people behind them were contacted.

Why the TEE did not help

Confidential computing protects data from the operator and the host. It does not defend the code running inside the enclave. NEAR AI states this directly: the SGLang vulnerability let the attacker run code inside one inference server and read requests as they were processed, confidential ones included.

This matters for how teams read attestation. Our explanation: a TEE attestation proves which code is running and that the hardware is genuine. It says nothing about whether that code is free of bugs. If the inference engine inside the enclave has an RCE, the attacker is already inside the boundary. NEAR AI says it will now treat the inference software and the services around the enclave with the same rigor as the enclave itself, and notes that the code, dependencies and deployment configurations of its confidential inference stack are public.

Brave’s October write-up says its Leo assistant runs chats with the GLM 5.3 Flash model inside a TEE operated by NEAR AI. NEAR AI has not said whether the affected server handled any of those chats.

What is still unknown

NEAR AI has not identified the flaw, named a CVE or the affected SGLang versions, or said whether SGLang has shipped a fix. As of 11 November we found no entry in the GitHub advisory database (newest SGLang entry 4 June), NVD (newest SGLang entry 19 October) or CISA KEV that NEAR AI or the SGLang project links to this incident. We cannot tell whether it is one of the many SGLang RCE CVEs already published. The report says only that the flaw was reported to the project and that a fix is deployed on all NEAR AI inference servers. Until the project publishes details, nobody outside the two teams can check which builds are exposed.

Response and guidance

After detection NEAR AI revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, deployed a fix for the SGLang flaw across its inference servers, rotated the remaining credentials and completed a forensic review. It has contacted affected users from [email protected] and asks everyone to be careful with unsolicited messages about their account or balance.

For teams that run their own inference stacks, our reading of the incident suggests four checks (these are our advice, not NEAR AI’s):

  1. Treat the inference engine as an internet-facing parser of untrusted input, and patch it on the same schedule as a web server.
  2. Keep API keys out of logs. Two customer keys were exposed in logs.
  3. Retire legacy deployments. The 18 agents ran outside the TEE, and the attacker reached them.
  4. Do not describe confidential mode as protection from the software vendor stack. Document what attestation does and does not cover.

References

Frequently Asked Questions

Did the trusted execution environment fail to protect NEAR AI's confidential requests?
NEAR AI says confidential computing does not protect against a vulnerability in the software running inside it. SGLang ran inside the environment, so code execution in SGLang could have given the attacker a view of requests being processed on that server, including confidential-mode requests. NEAR AI has not said any requests were actually observed.
What data did the attacker actually take?
NEAR AI has confirmed account details for about 100 Private Chat users (email addresses, names and, for some, plan and balance information). It also confirmed that data retrieved from 18 agents on a legacy deployment outside the TEE included chat history, settings and logs, and that two NEAR AI Cloud API keys were exposed in logs and have been revoked. It found no sign that stored Private Chat conversations or uploaded files were accessed.
Which SGLang versions are affected and is there a CVE?
NEAR AI has not identified the flaw or named versions, and says it reported the flaw to the SGLang project and fixed its own servers. As of 11 November we found no entry in the GitHub advisory database, NVD or CISA KEV that NEAR AI or the SGLang project links to this incident, and we cannot tell whether it is one of the many SGLang RCE CVEs already published. Our advice: watch the project for a fix and limit network exposure of SGLang in the meantime.