Skip to content
OpenAdvisories
Critical · 9.4 CVE-2026-85695 EUVD-2026-71144GHSA-46fr-7j3v-277v

FastChat Unauthenticated Worker Registration SSRF and Model Spoofing

Published Sep 4, 2026 · Updated Oct 1, 2026 · Assigned by VulnCheck

Description

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

Affected products

VendorProductAffectedFixed
lm-sys FastChat ≤ 0.2.36 —

References