FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompts, images, and responses, or probe internal network ports across the worker mesh.

FastChat, an open-source LLM serving framework, contains a critical authentication bypass vulnerability in its /register_worker endpoint. Unauthenticated attackers can exploit this flaw to register arbitrary worker addresses without any authentication. The vulnerability enables server-side request forgery (SSRF) by allowing attackers to register malicious workers under legitimate victim model names. This facilitates interception of sensitive user data including prompts, images, and model responses. Attackers can also leverage the vulnerability to probe and scan internal network ports across the worker mesh infrastructure. The issue is present in at least version v0.2.36 of FastChat as referenced in the controller.py source file. The vulnerability poses significant risks to AI/ML deployments using FastChat for model serving, potentially exposing confidential user interactions and internal network topology.