CVE-2026-85695

FastChat, the open-source LLM serving and evaluation platform from LMSYS, lacks required authentication on its controller's /register_worker endpoint (CWE-306). An unauthenticated attacker with network reachability to the controller can register a worker address under any model name, including a victim model's name, redirecting subsequent inference traffic through a host they control. This lets the attacker intercept user prompts, images, and model responses, and abuse the SSRF primitive to probe internal network ports across the worker mesh. Any self-hosted FastChat deployment whose controller is reachable from an untrusted network is affected, whether exposed directly to the internet or accessible from a compromised internal host. No public proof of concept, KEV listing, or in-the-wild exploitation is known; EPSS estimates a low 0.4% probability of exploitation within 30 days (percentile 35).

What to do: Restrict network access to the FastChat controller's /register_worker endpoint to trusted hosts only, and place any internet-exposed controller behind an authenticating reverse proxy until a vendor patch is available. Audit current worker registrations for unknown worker addresses or unexpected model names, and review logs for signs that prompts or responses were routed through an attacker-controlled worker.