# SGLang RCE Exploited Against NEAR AI Inference Server — Data Stolen From 18 Agents and ~100 Users

> An attacker exploited an unnamed remote code execution flaw in SGLang to run code on a NEAR AI inference server, pivoted into internal systems, downloaded account details for about 100 Private Chat users and took chat history, settings and logs from 18 non-TEE AI agents. Two customers' NEAR AI Cloud API keys exposed in logs were revoked.

- **Published:** 2026-11-11T00:04:57Z
- **Last reviewed:** 2026-11-11T00:04:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5697
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5697.png
- **ID:** TL-2026-5697
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-5760

## Description

NEAR AI disclosed on 2026-11-09 that an attacker exploited a remote code execution vulnerability in SGLang, the open-source LLM inference engine, to execute code on one of its inference servers. No CVE identifier, affected-version range or exploit detail has been published; NEAR AI reported the flaw to the SGLang project and deployed its own fix on all of its inference servers. It has not said whether the SGLang project has shipped an upstream fix, so the flaw should be treated as unpatched upstream until confirmed.

SGLang ran inside NEAR AI's trusted execution environment (TEE), and NEAR AI stated that the TEE does not protect against a vulnerability in the software running inside the enclave. The attacker could therefore observe requests being processed on the compromised server on 2026-11-08, including confidential-mode requests. Attestation and encryption in transit did not mitigate this, because the code that processes plaintext prompts was itself compromised.

From the inference server the attacker moved further into company systems. They reached an internal system behind the deprecated Private Chat product and downloaded account details (email addresses and names, and for some accounts plan and balance information) for about 100 users. NEAR AI saw no sign that stored Private Chat conversations or uploaded files were accessed. The attacker also reached 18 AI agents on an older NEAR AI Agents deployment that did not run in the TEE and took chat history, settings and logs. Two NEAR AI Cloud customers' API keys were exposed in those logs and have been revoked.

Response actions reported by NEAR AI: revoking all active sessions and administrator credentials, replacing all agent tokens, taking Private Chat offline, deploying the SGLang fix across all inference servers, rotating remaining credentials, completing a full forensic review, restoring NEAR AI Cloud access, and notifying affected users and agent owners (regulatory notifications to follow where required). Open questions per The Hacker News: whether people whose requests passed through the affected server were contacted, and whether the server handled chats from Brave's Leo assistant, which Brave documents as running GLM 5.3 Flash inside a NEAR AI-operated TEE. No IPs, domains, hashes, actor attribution or the specific vulnerable endpoint have been published. Other SGLang RCE flaws disclosed earlier in 2026 (for example CVE-2026-5760 via malicious GGUF chat templates, and pickle/dill deserialization issues) have NOT been tied to this incident by any source.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1021 Remote Services
- T1552.001 Unsecured Credentials: Credentials In Files
- T1005 Data from Local System
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SGLang Server Process Spawning Shell or Interpreter (NEAR AI-style RCE)** (`TL-2026-5697-SPL-001`)

TL-2026-5697: Detects a shell, downloader, netcat/socat or inline-python child process spawned by an SGLang inference-server process. An unnamed SGLang RCE was exploited against a NEAR AI inference server on 2026-11-08 (T1190 -> T1059); the inference engine normally never spawns interactive shells, so any hit is a high-fidelity behavioural indicator of code execution through the serving process.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.004, T1059.006
- **Data sources:** sysmon_for_linux, linux_auditd
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
  (ParentCommandLine="*sglang*" OR ParentImage="*sglang*")
  NOT CommandLine="*multiprocessing.spawn*"
| where match(Image, "(?i)/(sh|bash|dash|zsh|ash|busybox|nc|ncat|socat|curl|wget|perl|ruby|php)$") OR (match(Image, "(?i)/python[0-9.]*$") AND (like(CommandLine, "% -c %") OR like(CommandLine, "%pty.spawn%") OR like(CommandLine, "%socket%")))
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(User) as users by host, ParentImage, ParentCommandLine, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has "sglang"
| where ProcessCommandLine !has "multiprocessing.spawn"
| where FileName in~ ("sh","bash","dash","zsh","ash","busybox","nc","ncat","socat","curl","wget","perl","ruby","php")
    or (FileName startswith "python" and ProcessCommandLine has_any ("pty.spawn","socket"," -c "))
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: SGLang Inference Server Spawning Shell or Interpreter
id: 5f0c2b7e-3a41-4d8e-9b6a-1c7e8d2a4f01
status: experimental
description: Detects a shell, downloader, netcat/socat or inline python child process of an SGLang server process, consistent with the SGLang RCE exploited against NEAR AI (TL-2026-5697).
references:
  - https://near.ai/blog/security-incident-report-sglang-vulnerability
  - https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059.004
  - attack.t1059.006
logsource:
  product: linux
  category: process_creation
detection:
  selection_parent:
    ParentCommandLine|contains: 'sglang'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/ash'
      - '/busybox'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/curl'
      - '/wget'
      - '/perl'
      - '/ruby'
      - '/php'
  selection_py:
    Image|contains: '/python'
    CommandLine|contains:
      - 'pty.spawn'
      - 'socket'
      - ' -c '
  filter_mp:
    CommandLine|contains: 'multiprocessing.spawn'
  condition: selection_parent and (selection_child or selection_py) and not filter_mp
falsepositives:
  - Administrators debugging a container by exec-ing a shell under the serving process
  - Launcher scripts that wrap SGLang in a shell and call curl for health checks
level: high

```

**Known false positives:**

- Admin debugging via a shell launched from the SGLang process tree
- Wrapper scripts that invoke curl/wget for health checks or model downloads at start-up

**Tuning notes:** Restrict to hosts in your SGLang inventory; exclude known launcher/health-check command lines. If SGLang runs in containers, ensure ParentCommandLine is populated (Sysmon for Linux or EDR container visibility).

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- [indicator] Child Process Fetching Payload or Opening Reverse Shell (locked: unlock with TL Creds)
- [indicator] Descendant Staging Data or Dumping Account Databases (locked: unlock with TL Creds)
- [indicator] Descendant Using Remote Service Clients (SSH, SCP, psql, kubectl) (locked: unlock with TL Creds)
- Unexpected Child Process of [indicator] Server (Allowlist Baseline) (locked: unlock with TL Creds)
- [indicator] Descendant Uploading Data via curl or wget (locked: unlock with TL Creds)
- Shell or Download Tool Reaching Cloud Instance Metadata Service on Inference Host (locked: unlock with TL Creds)
- [indicator] Descendant Harvesting Secrets, Environment and Logs (locked: unlock with TL Creds)
- Inference Host Connecting to Internal Account, Database or Cluster Services (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users](https://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.html)
- [NEAR AI Security Incident Report: SGLang Vulnerability](https://near.ai/blog/security-incident-report-sglang-vulnerability)
- [NEAR AI follow-up post on X](https://x.com/near_ai/status/2120043366444601458)
- [Brave: Browser AI with end-to-end encryption (Leo on NEAR AI TEE)](https://brave.com/blog/browser-ai-e2ee/)
- [Related context, not attributed to this incident: SGLang CVE-2026-5760 (CVSS 9.8) RCE via malicious GGUF model files](https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html)
- [Related context, not attributed to this incident: CSA research note on SGLang RCE and MCP memory poisoning](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-infrastructure-vulnerabilities-sglang-m/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5697