Remote Code Execution in Pipecat Framework

Executive Summary

The CVE-2026-54695 vulnerability in the pipecat-ai/pipecat project involves an unauthenticated call-control abuse flaw in the Telephony WebSocket endpoint (`/ws`).

An attacker can connect to the unauthenticated `/ws` WebSocket endpoint, send a crafted Twilio handshake message containing a malicious `callSid`, and force the server to issue an authenticated Twilio REST API hang-up request against that call SID using the server operator's credentials.

This means the attacker can terminate active calls on the victim's Twilio account if they know or obtain a valid call SID. Similar vulnerabilities exist for Telnyx and Plivo integrations.

The root cause is that the server accepts WebSocket connections without authentication, extracts the `callSid` directly from attacker-controlled input, and uses it in API calls with the server's own credentials.

This issue affects pipecat versions up to 0.0.77 and versions before 1.4.0, and has been fixed in version 1.4.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to forcibly terminate active calls on your telephony account by abusing the unauthenticated WebSocket endpoint.

It can lead to denial of service by disrupting legitimate call sessions.

Additionally, unauthorized call-control actions can be performed using your telephony provider credentials, potentially causing operational disruptions and misuse of your telephony resources.

The attack is feasible if the development runner's telephony `/ws` endpoint is exposed to untrusted networks and configured with Twilio, Telnyx, or Plivo credentials.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the pipecat development runner is exposing the /ws WebSocket endpoint without authentication. Monitoring network traffic for unauthenticated WebSocket connections to the /ws endpoint can indicate exposure.

You can use network inspection tools like tcpdump or Wireshark to capture WebSocket traffic on the relevant ports and look for connections to the /ws endpoint.

Additionally, you can use command-line tools such as curl or websocat to attempt connecting to the /ws WebSocket endpoint without authentication to test if it is accessible.

• Use tcpdump to capture WebSocket traffic: tcpdump -i <interface> -A port <port_number> | grep '/ws'
• Use websocat to test unauthenticated WebSocket connection: websocat ws://<server_address>/ws
• Use curl to check HTTP upgrade requests (though limited for WebSocket): curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" ws://<server_address>/ws

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade pipecat to version 1.4.0 or later, where the vulnerability is fixed by adding HMAC token authentication for WebSocket connections.

If upgrading immediately is not possible, restrict network access to the /ws WebSocket endpoint to trusted networks only, preventing unauthenticated external access.

Enable the WebSocket authentication feature by setting the environment variable PIPECAT_WEBSOCKET_AUTH=token or using the CLI flag --ws-auth token to require clients to authenticate with a short-lived HMAC token before establishing WebSocket connections.

Monitor WebSocket connections and reject any invalid, expired, or replayed tokens to prevent unauthorized call-control actions.

Useful 0 Not Useful 0

Compliance Impact

The provided context and resources do not explicitly discuss the impact of CVE-2026-54695 on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0