An attacker used a remote code execution flaw in SGLang, the open-source inference engine, to run code on one of NEAR AI’s inference servers last Sunday, The Hacker News reports.
- The attacker may have seen requests processed on that server that day, including ones sent in “confidential mode” inside a trusted execution environment. NEAR AI was blunt about it: the TEE “does not protect against a vulnerability in the software running inside the environment.”
- From there the attacker reached an internal system behind Private Chat, a product NEAR AI had already deprecated, and downloaded names, emails, and some plan and balance details for about 100 users.
- The attacker also pulled chat history, settings and logs from 18 agents on an older deployment that wasn’t running in the TEE. Two customers’ API keys were exposed in logs and have been revoked.
- NEAR AI revoked all sessions and admin credentials, replaced agent tokens, took Private Chat offline and patched SGLang on its servers.
Here’s the part that worries me: NEAR AI hasn’t given a CVE, named the affected SGLang versions, or said whether the SGLang project has shipped a fix.
My take
If you self-host SGLang, keep it off the internet behind an authenticating proxy until a fixed release and a CVE show up, and watch the project’s releases. And a TEE protects the box, not the buggy code you run inside it. Needs Garlic until upstream says something.
God Bless, and Needs Garlic!
