CVE-2026-102682

Deferred Deferred - Pending Action

Unauthenticated Endpoint Exposure in Pipecat AI Framework

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default and is intended only for local development, so exploitation requires an operator to expose it to untrusted traffic through --host 0.0.0.0, a published port, or a tunnel without access controls. An unauthenticated caller can consume local resources and third-party quotas and, depending on configuration, receive a room URL and join token. Version 1.6.0 adds a prominent development-runner banner and documentation that clarifies the unauthenticated boundary and directs production deployments to an authenticated dispatcher or managed runtime, while the endpoint behavior remains by design. This issue is fixed in version 1.6.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102682

EUVD

EUVD-2026-101601

Affected Vendors & Products

Vendor	Product	Version / Range
pipecat-ai	pipecat	>= 0.0.98, < 1.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

Pipecat is a Python framework for building real-time voice and multimodal conversational agents. This vulnerability involves the development runner in versions 0.0.98 to 1.6.0, which exposes unauthenticated endpoints like /start, /daily, and /daily-dialin-webhook. These endpoints allow unauthenticated users to create bot sessions and Daily rooms if the runner is exposed to untrusted traffic, such as binding to 0.0.0.0 or using a public tunnel without access controls.

Detection Guidance

Check if the Pipecat development runner is bound to 0.0.0.0 or a public interface. Use commands like 'netstat -tulnp | grep pipecat' or 'ss -tulnp | grep pipecat' to list listening ports and associated processes. Verify if endpoints like /start, /daily, or /daily-dialin-webhook are exposed by accessing them via curl or a browser.

Impact Analysis

If exploited, this vulnerability could allow unauthenticated users to consume local resources and third-party quotas, create bot sessions or paid Daily rooms, and receive sensitive URLs and join tokens. The impact depends on the bot's configuration and connected tools, but it does not inherently grant access to external systems or sensitive information.

Compliance Impact

This vulnerability primarily affects compliance by enabling unauthorized resource consumption and potential exposure of sensitive URLs and tokens if the development runner is exposed to untrusted networks. While it does not directly grant access to external systems or sensitive data, improper exposure could lead to violations of data protection principles under GDPR or HIPAA if personal or health-related data is processed without proper controls. The lack of authentication and authorization mechanisms in the development runner increases the risk of unauthorized access, which may conflict with regulatory requirements for access controls and data integrity.

Mitigation Strategies

Stop exposing the development runner to untrusted networks. Ensure the runner binds only to localhost (127.0.0.1) by default. Upgrade to Pipecat version 1.6.0 or later for improved warnings. Avoid using --host 0.0.0.0 or public tunnels without access controls.

Hi! I’m here to help you understand CVE-2026-102682. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70