SGLang RCE Exploited Against NEAR AI Inference Server — Data Stolen From 18 Agents and ~100 Users

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5697 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SGLang Server Process Spawning Shell or Interpreter (NEAR AI-style RCE)

TL-2026-5697: Detects a shell, downloader, netcat/socat or inline-python child process spawned by an SGLang inference-server process. An unnamed SGLang RCE was exploited against a NEAR AI inference server on 2026-11-08 (T1190 -> T1059); the inference engine normally never spawns interactive shells, so any hit is a high-fidelity behavioural indicator of code execution through the serving process.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059, T1059.004, T1059.006
• Data sources: sysmon_for_linux, linux_auditd
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
  (ParentCommandLine="*sglang*" OR ParentImage="*sglang*")
  NOT CommandLine="*multiprocessing.spawn*"
| where match(Image, "(?i)/(sh|bash|dash|zsh|ash|busybox|nc|ncat|socat|curl|wget|perl|ruby|php)$") OR (match(Image, "(?i)/python[0-9.]*$") AND (like(CommandLine, "% -c %") OR like(CommandLine, "%pty.spawn%") OR like(CommandLine, "%socket%")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host, ParentImage, ParentCommandLine, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has "sglang"
| where ProcessCommandLine !has "multiprocessing.spawn"
| where FileName in~ ("sh","bash","dash","zsh","ash","busybox","nc","ncat","socat","curl","wget","perl","ruby","php")
    or (FileName startswith "python" and ProcessCommandLine has_any ("pty.spawn","socket"," -c "))
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: SGLang Inference Server Spawning Shell or Interpreter
id: 5f0c2b7e-3a41-4d8e-9b6a-1c7e8d2a4f01
status: experimental
description: Detects a shell, downloader, netcat/socat or inline python child process of an SGLang server process, consistent with the SGLang RCE exploited against NEAR AI (TL-2026-5697).
references:
  - https://near.ai/blog/security-incident-report-sglang-vulnerability
  - https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - attack.t1059.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains: 'sglang'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/ash'
      - '/busybox'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
      - '/perl'
      - '/ruby'
      - '/php'
  selection_py:
    Image|contains: '/python'
    CommandLine|contains:
      - 'pty.spawn'
      - 'socket'
      - ' -c '
  filter_mp:
    CommandLine|contains: 'multiprocessing.spawn'
  condition: selection_parent and (selection_child or selection_py) and not filter_mp
falsepositives:
  - Administrators debugging a container by exec-ing a shell under the serving process
  - Launcher scripts that wrap SGLang in a shell and call curl for health checks
level: high

Known false positives:

• Admin debugging via a shell launched from the SGLang process tree
• Wrapper scripts that invoke curl/wget for health checks or model downloads at start-up

Tuning notes: Restrict to hosts in your SGLang inventory; exclude known launcher/health-check command lines. If SGLang runs in containers, ensure ParentCommandLine is populated (Sysmon for Linux or EDR container visibility).

• 🔒 [indicator] Child Process Fetching Payload or Opening Reverse Shell · unlock with TL Creds
• 🔒 [indicator] Descendant Staging Data or Dumping Account Databases · unlock with TL Creds
• 🔒 [indicator] Descendant Using Remote Service Clients (SSH, SCP, psql, kubectl) · unlock with TL Creds
• 🔒 Unexpected Child Process of [indicator] Server (Allowlist Baseline) · unlock with TL Creds
• 🔒 [indicator] Descendant Uploading Data via curl or wget · unlock with TL Creds
• 🔒 Shell or Download Tool Reaching Cloud Instance Metadata Service on Inference Host · unlock with TL Creds
• 🔒 [indicator] Descendant Harvesting Secrets, Environment and Logs · unlock with TL Creds
• 🔒 Inference Host Connecting to Internal Account, Database or Cluster Services · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5697.

Technical analysis

Two customers' NEAR AI Cloud API keys exposed in logs were revoked.

NEAR AI disclosed on 2026-11-09 that an attacker exploited a remote code execution vulnerability in SGLang, the open-source LLM inference engine, to execute code on one of its inference servers. No CVE identifier, affected-version range or exploit detail has been published; NEAR AI reported the flaw to the SGLang project and deployed its own fix on all of its inference servers. It has not said whether the SGLang project has shipped an upstream fix, so the flaw should be treated as unpatched upstream until confirmed.

SGLang ran inside NEAR AI's trusted execution environment (TEE), and NEAR AI stated that the TEE does not protect against a vulnerability in the software running inside the enclave. The attacker could therefore observe requests being processed on the compromised server on 2026-11-08, including confidential-mode requests. Attestation and encryption in transit did not mitigate this, because the code that processes plaintext prompts was itself compromised.

From the inference server the attacker moved further into company systems. They reached an internal system behind the deprecated Private Chat product and downloaded account details (email addresses and names, and for some accounts plan and balance information) for about 100 users. NEAR AI saw no sign that stored Private Chat conversations or uploaded files were accessed. The attacker also reached 18 AI agents on an older NEAR AI Agents deployment that did not run in the TEE and took chat history, settings and logs. Two NEAR AI Cloud customers' API keys were exposed in those logs and have been revoked.

Response actions reported by NEAR AI: revoking all active sessions and administrator credentials, replacing all agent tokens, taking Private Chat offline, deploying the SGLang fix across all inference servers, rotating remaining credentials, completing a full forensic review, restoring NEAR AI Cloud access, and notifying affected users and agent owners (regulatory notifications to follow where required). Open questions per The Hacker News: whether people whose requests passed through the affected server were contacted, and whether the server handled chats from Brave's Leo assistant, which Brave documents as running GLM 5.3 Flash inside a NEAR AI-operated TEE. No IPs, domains, hashes, actor attribution or the specific vulnerable endpoint have been published. Other SGLang RCE flaws disclosed earlier in 2026 (for example CVE-2026-5760 via malicious GGUF chat templates, and pickle/dill deserialization issues) have NOT been tied to this incident by any source.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Unsecured Credentials: Credentials In Files

Remediation

Patches

• NEAR AI deployed a private fix on its own inference servers; whether SGLang upstream has released a fix is not stated. Track the SGLang project's security advisories and upgrade as soon as a fix is published

Immediate actions

• Identify every SGLang deployment (including inside TEEs/confidential-computing enclaves) and restrict network exposure of its serving endpoints to trusted callers only
• Rotate API keys, agent tokens, sessions and administrator credentials on any host that ran an exposed SGLang instance
• Search application and inference logs for secrets (API keys, tokens) and purge or redact them
• Review inference-server logs and egress for unexpected child processes, outbound connections and internal-system access

Workarounds

• Do not expose SGLang HTTP/RPC endpoints to untrusted networks; disable optional features not required (e.g., custom logit processors, multimodal generation modes) until the vulnerable component is identified

Longer-term hardening

• Treat inference software as part of the trusted computing base: apply the same security review to inference engines and surrounding services as to the enclave
• Segment inference servers from internal account, billing and agent systems; avoid long-lived credentials reachable from inference hosts
• Keep legacy or deprecated AI services out of production or move them into the same protections as current services
• Stop writing credentials to logs; enforce secret scanning on log pipelines

Affected and fixed versions

• SGLang project — SGLang (open-source LLM inference engine)
  Vulnerable versions: Not specified
  Fixed in: Not specified; NEAR AI deployed its own fix
• NEAR AI — NEAR AI Private Chat (deprecated), legacy NEAR AI Agents deployment, NEAR AI Cloud inference servers
  Vulnerable versions: Deployments as of 2026-11-08
  Fixed in: Fix deployed on all inference servers per NEAR AI

Timeline

• 2025-11-01 Brave's earlier release of NEAR AI TEE-backed Leo chats (November 2025) relied on server-side verification of TEE proofs; month-level date per Brave's write-up
• 2026-10-15 Brave publishes technical write-up of end-to-end encrypted Leo chats running GLM 5.3 Flash inside a NEAR AI-operated TEE
• 2026-11-08 Attacker moves into internal systems: downloads account details for ~100 users from a system behind deprecated Private Chat and takes chat history, settings and logs from 18 non-TEE legacy agents (exact date of this stage not stated; assumed same incident window)
• 2026-11-08 Attacker exploits an SGLang RCE to run code on a NEAR AI inference server and could observe requests processed on it, including confidential-mode requests
• 2026-11-09 NEAR AI posts a follow-up stating forensic review is complete, NEAR AI Cloud access is restored and affected users are notified via security@near.ai
• 2026-11-09 NEAR AI publishes its security incident report: sessions and admin credentials revoked, agent tokens replaced, Private Chat taken offline, fix deployed on all inference servers, two exposed Cloud API keys revoked, flaw reported to SGLang project
• 2026-11-10 The Hacker News reports the incident; no CVE, affected versions, upstream fix status or IOCs are public

Sources cited

• NEAR AI Security Incident Report: SGLang Vulnerability near.ai · Vendor report · 2026-11-09
• NEAR AI follow-up post on X x.com · Vendor report · 2026-11-09
• Related context, not attributed to this incident: CSA research note on SGLang RCE and MCP memory poisoning labs.cloudsecurityalliance.org · Research
• Brave: Browser AI with end-to-end encryption (Leo on NEAR AI TEE) brave.com · Blog · 2026-10-15
• SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users The Hacker News · News · 2026-11-10
• Related context, not attributed to this incident: SGLang CVE-2026-5760 (CVSS 9.8) RCE via malicious GGUF model files The Hacker News · News

More in vulnerability

• CVE-2026-119618: Critical Unauthenticated RCE via Race Condition in Apache HTTP Server mod_http2 assign_headers()
• Axis Camera Station and Camera Station Pro: Multiple Vulnerabilities (CVE-2026-13312, CVE-2026-12389, CVE-2026-12964 and others)
• N-able N-central: 33 Alleged Zero-Day Vulnerabilities Published with PoC ("Able2Shell" XXE-to-RCE chain); Platform Taken Offline
• Apple Libnotify/notifyd Stack-Based Buffer Overflow (CVE-2026-64739)
• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation

Previous and next in vulnerability

• Microsoft November 2026 Patch Release: 1,093 Vulnerabilities Fixed, Outlook Spoofing Zero-Day CVE-2026-124194 Actively Exploited Previous report
• Microsoft Patch Tuesday November 2026: ~1,095 vulnerabilities, 64 critical, one exploited Outlook NTLM-leak spoofing zero-day (CVE-2026-124194) Next report