CVE-2026-85695 is a missing authentication flaw in the FastChat controller (CVSS 9.4, critical). The /register_worker endpoint accepts any worker address, which enables SSRF and model spoofing. I could not confirm a fixed version. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
VulnCheck lists FastChat up to 0.2.36. The weakness is CWE-306, missing authentication for a critical function. The record says an unauthenticated attacker can register arbitrary worker addresses with the controller.
That allows two things, per the record: registering a malicious worker under a real model name to intercept prompts, images and responses, and probing internal network ports across the worker mesh through server side requests. No fixed release appears in the record or the pages I could read, so check the FastChat repository and issue 3886. The record is not in the CISA KEV catalog.
How to check if you're exposed
Find your FastChat version and see where the controller listens.
pip show fschat
ss -ltnp | grep -i controller
If the controller port is reachable from outside the machine or from an untrusted network, anyone there could call the registration endpoint.
What to do now
- Bind the controller to localhost or a private interface only.
- Block the controller port at the firewall from anything but your worker hosts.
- Put an authenticating proxy in front of the controller if remote access is needed.
- Check the controller worker list for addresses you do not recognize.
- Watch the FastChat repository for a release that adds authentication, and upgrade when it exists.
Why it matters
The controller is the routing brain of a FastChat deployment. It trusts whoever tells it where a worker lives. With no authentication, an outsider can insert themselves into the path between users and the model.
Two separate harms follow. One is data exposure, since prompts and replies are routed through an attacker. The other is SSRF, where the controller makes requests to addresses chosen by the caller.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patch?
I could not confirm one. Treat the controller as an internal service and restrict access until the project says otherwise.
Sources
Last reviewed: 19 October 2026.
