Description

FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-09-04T15:17:47.690Z",
  "pubdate": "2026-09-04T15:17:47.690Z",
  "executiveSummary": "FastChat is susceptible to an authentication bypass vulnerability located within the /register_worker endpoint, which facilitates unauthorized interaction with the controller mesh.\nThis security flaw enables unauthenticated remote attackers to register arbitrary worker nodes, thereby subverting the model serving infrastructure.\nThe vulnerability allows for significant malicious activity, including Server-Side Request Forgery (SSRF), traffic interception, and the potential for credential or data exfiltration.\nBy masquerading as legitimate workers, an attacker can position themselves as a man-in-the-middle to intercept sensitive user prompts, uploaded images, and subsequent model responses.\nThe risk is severe as it compromises the integrity of the model serving pipeline and provides a vector for lateral movement into internal networks by abusing the controller's ability to probe internal services.\nNo specific version numbers were provided in the disclosure; however, all deployments utilizing the /register_worker endpoint without enforced authentication are considered vulnerable.\nExploitation requires network connectivity to the controller instance, with no prior authentication or privilege escalation steps necessary, making the attack surface highly accessible to external threats.",
  "technicalDetails": "The vulnerability resides in the /register_worker endpoint of the FastChat controller component. The root cause is the absence of robust authentication mechanisms or cryptographically verifiable tokens required to authorize the registration of new worker nodes into the cluster.\nAn attacker can exploit this by sending a crafted HTTP POST request to the /register_worker endpoint. Because the endpoint does not validate the identity of the requester, the controller accepts the attacker-provided worker address and model metadata as legitimate entries within the worker mesh registry.\nOnce the malicious worker is registered, the controller begins routing legitimate traffic, including user queries and model inference requests, to the attacker-controlled address. This enables a sophisticated interception attack where the attacker can inspect, modify, or log sensitive data transmitted between the user and the FastChat service.\nFurthermore, the vulnerability enables Server-Side Request Forgery (SSRF). Because the controller interacts with registered workers to manage the model lifecycle and health checks, an attacker can manipulate the controller into making requests to arbitrary internal network resources or local loopback services that would otherwise be protected by perimeter firewalls.\nStep-by-step exploitation flow:\n1. Reconnaissance: The attacker identifies the publicly accessible or reachable /register_worker endpoint on the FastChat controller.\n2. Registration: The attacker crafts a payload specifying a malicious worker URL and identifying it with the name of a legitimate or high-value model hosted on the network.\n3. Interception: The controller updates its routing table, effectively re-directing traffic destined for the victim model to the attacker's infrastructure.\n4. Exfiltration: The attacker processes incoming requests, captures user-provided context or data, and potentially proxies the request to the real model to maintain stealth while exfiltrating sensitive inputs.\n5. Pivoting: The attacker triggers controller-initiated requests to probe the internal infrastructure, utilizing the controller's legitimate identity to bypass network access controls.\nThe post-exploitation impact includes complete loss of confidentiality regarding user inputs and responses, unauthorized access to the internal network mesh, and potential disruption of service (DoS) by unregistering legitimate workers or causing state inconsistencies within the controller registry."
}