Authentication Bypass and SSRF in FastChat /register_worker Endpoint

FastChat is vulnerable to an authentication bypass within its /register_worker endpoint, tracked as CVE-2026-85695. This flaw allows unauthenticated remote attackers to register malicious worker nodes to the FastChat controller without proper authorization. By registering these arbitrary worker addresses, an attacker can manipulate the worker mesh, perform server-side request forgery (SSRF) against internal services reachable from the controller, and intercept sensitive data. Specifically, malicious workers can be configured to process requests intended for legitimate models, allowing the attacker to capture user prompts, uploaded images, and model responses. This poses a severe risk to confidentiality and integrity within distributed LLM infrastructure, as the attacker effectively becomes a man-in-the-middle for model interactions.

Impact

The vulnerability carries a CVSS v3.1 base score of 9.4, reflecting the critical nature of the authentication bypass. Successful exploitation allows for the interception of sensitive AI prompts and responses, as well as the potential for unauthorized scanning or exploitation of internal network resources via SSRF. Organizations relying on FastChat for distributed model serving are at risk of data exfiltration and unauthorized access to internal infrastructure.

Recommendation

Prioritize the identification of internet-facing FastChat controller instances and ensure they are patched to the latest version. Monitor web server logs for suspicious POST requests to the /register_worker endpoint originating from unauthorized or unexpected IP addresses.