EUVD-2026-71144
GHSA-46fr-7j3v-277v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed FastChat controller
-
DeliveryPOST to unauthenticated /register_worker
-
ExploitRegister rogue worker under victim model name
-
ExecutionController routes user traffic to attacker
-
ImpactIntercept prompts/images/responses or probe internal ports
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the FastChat controller service and its /register_worker endpoint, which by design performs no authentication (CWE-306) - so exploitation succeeds against default configurations wherever the controller is reachable by the attacker. The practical limiting factor is exposure of the controller port: deployments that keep the controller on an isolated/trusted-only network are not remotely exploitable by outsiders. For the model-spoofing/interception impact, victim users must actually route requests to the spoofed model name after the rogue worker is registered; for the SSRF/port-probing impact, the controller must have network paths to the internal targets. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L) describes a straightforward network-reachable, low-complexity, unauthenticated attack with high confidentiality and integrity impact - consistent with the described unauthenticated registration abuse - yielding a 9.3 base score. The two impacts reinforce each other: model spoofing gives high confidentiality (prompt/response interception) and high integrity (attacker returns forged responses), while SSRF into the worker mesh provides internal reconnaissance. Real-world priority is tempered by exposure: the risk is only material where the FastChat controller port is reachable by an attacker (any deployment that exposes the controller beyond a trusted network is directly exploitable, so treat internet- or shared-network-exposed controllers as high priority). There is no EPSS score, no KEV listing, and no confirmed public POC in the provided data - so this reflects assessed severity rather than observed exploitation. The reporting by VulnCheck with a dedicated advisory raises confidence that the technical mechanism is real. |
| Exploit ScenarioDerived | An attacker who can reach the FastChat controller sends an unauthenticated HTTP request to /register_worker announcing a worker they control under the name of a legitimate model (e.g. 'vicuna-13b'). Subsequent user chat traffic routed to that model name is transparently proxied through the attacker's worker, capturing prompts, images, and responses while returning attacker-chosen answers; the same registration primitive can point the controller at internal IP:port pairs to enumerate the internal network. No authentication, user interaction, or special privileges are required, matching the AV:N/AC:L/PR:N/UI:N vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 04, 2026
Server-side request forgery and model spoofing in lm-sys FastChat let unauthenticated remote attackers register arbitrary workers via the controller's /register_worker endpoint, which performs no authentication. By registering a malicious worker address under a legitimate model's name, an attacker can silently intercept user prompts, uploaded images, and model responses, or coerce the controller into probing internal network ports across the worker mesh. No public exploit identified at time of analysis; the issue was reported by VulnCheck and CVSS 4.0 is scored 9.3.
RemediationAI
No vendor-released patch identified at time of analysis; the references are an open GitHub issue (#3886) and the VulnCheck advisory rather than a tagged fixed release, so monitor https://github.com/lm-sys/FastChat/issues/3886 and the VulnCheck advisory for a fixed version. As compensating controls, do not expose the FastChat controller port to untrusted networks - bind it to localhost or a private management subnet and place it behind a reverse proxy that enforces authentication and network ACLs on /register_worker (trade-off: legitimate distributed workers must then present the same credential/be whitelisted, so worker startup must be updated). Restrict the controller's outbound network reach with egress firewall rules or network segmentation so a registered worker address cannot reach sensitive internal hosts/ports, blunting the SSRF (trade-off: workers on other subnets must be explicitly allowed). Where feasible, run workers and controller on an isolated trusted network only, and audit registered worker addresses/model-name mappings for unexpected entries.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FastChat is an open-source platform (lm-sys) for serving, training, and evaluating large language model chatbots (e.g., Vicuna), using a distributed controller/worker architecture. The controller (fastchat/serve/controller.py) tracks model workers and routes user requests to them. The vulnerable /register_worker endpoint accepts a worker's address and the model names it serves with no credential or origin check (CWE-306, Missing Authentication for a Critical Function). Because the controller then issues requests to whatever address a caller registers, the flaw doubles as an SSRF primitive: the controller can be made to reach arbitrary internal hosts/ports, and because worker-to-model-name mapping is attacker-controllable, a rogue worker can shadow a real model name and become the interception point for all traffic routed to that model. The affected component is identified by CPE cpe:2.3:a:lm-sys:fastchat:*:*:*:*:*:*:*:*, referenced against source at tag v0.2.36.
Know when Fastchat gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Network-reachable, unauthenticated registration (AV:N/AC:L/PR:N/UI:N) yields full prompt/response interception (C:H) and forged responses/spoofing (I:H); SSRF/probing gives limited availability impact (A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.
Executive ViewAI
FastChat, an open-source LLM serving platform used by organizations, exposes an unauthenticated worker registration vulnerability (CVSS 9.3) that allows attackers to register malicious workers and intercept all user prompts, uploaded documents, and model responses. Organizations deploying FastChat face immediate risk of sensitive data exfiltration and silent compromise of inference outputs.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to /register_worker endpoint via firewall or reverse-proxy authentication (OAuth2, API keys, or mTLS); (2) Implement mandatory authentication and authorization checks before accepting worker registrations; (3) Deploy monitoring and alerting on all worker registration attempts and anomalous worker communication patterns; (4) Isolate FastChat worker mesh to internal-only networks with no external connectivity; (5) Maintain and regularly audit an authorized-workers whitelist with real-time validation; (6) Enable comprehensive audit logging of all registration, worker lifecycle, and inter-worker communication events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Contro
A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. Rated high
A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. Rated high severity (CVSS 7
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the
In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of multipart bou
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect u
Resource exhaustion in lm-sys FastChat up to 0.2.36 allows remote attackers to trigger denial of service by sending mani
Information disclosure in lm-sys FastChat up to version 0.2.36 allows remote unauthenticated attackers to manipulate the
Exploit-DB