CVE-2026-85695 in FastChat
Summary
by MITRE • 09/04/2026
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The FastChat framework, a popular open-source platform for training and deploying large language models, contains a critical authentication bypass vulnerability within its /register_worker endpoint. This flaw stems from insufficient access control mechanisms that fail to verify the identity of entities attempting to register as workers in the distributed inference mesh. In a typical deployment, worker nodes are responsible for handling computational tasks such as serving model weights or processing user inputs. The architecture relies on trust between these components, but this vulnerability allows an unauthenticated attacker to inject themselves into this trusted network by registering arbitrary worker addresses under existing victim model names. This misconfiguration effectively breaks the isolation boundaries intended to protect internal services and sensitive data flows within the cluster.
From a technical perspective, the exploitation of this flaw enables Server-Side Request Forgery (SSRF) attacks against the internal infrastructure supporting the language model deployment. By registering malicious worker endpoints that mimic legitimate nodes, an attacker can manipulate how requests are routed or processed by the central server. This capability allows for two primary attack vectors: data interception and network reconnaissance. First, attackers can position their controlled workers to intercept user prompts, image inputs, and generated responses intended for specific models. Since these interactions often contain sensitive personal information or proprietary business logic, such interception poses a severe privacy risk. Second, the ability to register arbitrary addresses facilitates probing of internal network ports across the worker mesh, allowing adversaries to map out the internal topology, identify other vulnerable services, and potentially pivot further into the organization's private network segments.
The operational impact of this vulnerability is significant for any production environment relying on FastChat for serving large language models. The compromise undermines the integrity of the model-serving infrastructure by allowing unauthorized entities to participate in request handling. This can lead to data leakage where confidential user queries and AI-generated outputs are exfiltrated to attacker-controlled servers. Furthermore, the ability to probe internal ports increases the attack surface significantly, potentially exposing other backend services that were not designed to be accessible from external or untrusted networks. For organizations using this framework for customer-facing applications or internal enterprise tools, such a breach could result in regulatory violations related to data protection and loss of trust among users who expect their interactions with AI systems to remain private and secure.
Mitigation strategies must focus on implementing strict authentication and authorization checks at the /register_worker endpoint. Developers should enforce mutual TLS (mTLS) or token-based authentication for all worker registration requests, ensuring that only pre-approved and verified nodes can join the mesh. Additionally, network-level controls such as firewalls and security groups should restrict inbound connections to the FastChat server exclusively from known internal IP ranges associated with legitimate workers. Input validation on registered addresses is also crucial; systems should validate that provided hostnames or IPs belong to expected subnets rather than accepting arbitrary external domains. Regular audits of worker registrations and monitoring for anomalous registration patterns can help detect exploitation attempts early, while keeping the FastChat software updated ensures access to any future patches addressing these security gaps in alignment with industry standards like CWE-287 for Improper Authentication and ATT&CK techniques related to lateral movement and data exfiltration.