FastChat Worker Registration Authentication Bypass

Technical Analysis

CVE-2026-85695 stems from missing authentication and input validation on FastChat's /register_worker API, which is used by the controller to dynamically discover and route requests to model-serving workers. An unauthenticated attacker can submit a crafted worker registration request, effectively spoofing a legitimate model name and redirecting the controller's routing table to an attacker-controlled endpoint, resulting in a man-in-the-middle position over all inference traffic. The same endpoint can be abused for SSRF, allowing the attacker to pivot and probe internal services, metadata endpoints, and other workers behind the trust boundary of the FastChat deployment. Because FastChat is widely used as an open-source multi-model serving backend for chatbot and agent applications, this flaw directly threatens AI agent systems: any agent or RAG pipeline routing model calls through a vulnerable FastChat controller risks prompt/response interception, exfiltration of embedded API keys or credentials passed in requests, and poisoning of model outputs returned to downstream agent logic.

Affected Systems

FastChat deployments exposing the controller's /register_worker endpoint without authentication, including self-hosted multi-model serving clusters, LLM gateway integrations, and agent orchestration platforms using FastChat as a backend router; specific vulnerable version range pending vendor advisory confirmation.

Indicators of Compromise

• Unusual POST requests to /register_worker from unexpected or external source IPs
• Duplicate or conflicting worker addresses for known model names in controller logs
• Unexpected outbound connections from the FastChat controller to non-worker internal hosts (SSRF probing)
• Spikes in worker registration/deregistration events outside normal deployment cycles

Remediation Steps

1. 1

   Restrict endpoint access

   Place /register_worker and other controller management endpoints behind network-level access controls (firewall rules, VPC restrictions, mutual TLS) so only trusted worker hosts can register.

2. 2

   Apply vendor patch

   Upgrade FastChat to the patched release once available and monitor the project's security advisories for this CVE.

3. 3

   Implement authentication

   Add authentication tokens or mTLS between controller and worker nodes if not natively supported, using a reverse proxy or sidecar as an interim mitigation.

4. 4

   Audit worker registry

   Review current worker registration logs for duplicate model names, unexpected addresses, or workers registered from unauthorized IP ranges.

5. 5

   Rotate exposed credentials

   Rotate any API keys, tokens, or secrets that may have transited through the affected FastChat deployment, especially those used by downstream AI agents or automation pipelines.

6. 6

   Network segmentation

   Segment the worker mesh from sensitive internal services to limit SSRF-based lateral reconnaissance impact.