CVE Feed

    Dashboard / CVE / CVE-2024-10044

    CVE-2024-10044

    A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the POST /register_worker endpoint.

    Published:Dec 30, 2024
    Last Modified:Jul 29, 2025
    EPS:Dec 30, 2024
    EPSS Score:0.00112
    CVSS Score:9.3

    Affected Products

    Vendor
    Lm-sys
    Product
    Fastchat

    Exploits

    https://huntr.com/bounties/44633540-377d-4ac4-b3a3-c2d0fa19d0e6

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-85695 (CVSS 9.3) — FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthen…
    CVE-2026-6608 (CVSS 5.5) — A vulnerability was detected in lm-sys fastchat up to 0.2.36. Impacted is the function add_text of the compone…
    CVE-2026-6607 (CVSS 5.5) — A security vulnerability has been detected in lm-sys fastchat up to 0.2.36. This issue affects the function ap…
    CVE-2024-10907 (CVSS 7.5) — In lm-sys/fastchat Release v0.2.36, the server fails to handle excessive characters appended to the end of mul…
    CVE-2024-10912 (CVSS 7.5) — A Denial of Service (DoS) vulnerability exists in the file upload feature of lm-sys/fastchat version 0.2.36. T…
    CVE-2024-12376 (CVSS 7.5) — A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifica…
    CVE-2024-11603 (CVSS 7.5) — A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability…
    CVE-2024-10908 (CVSS 6.1) — An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High