CVE-2026-54695

HighCVSS 7.5

Published: 09/07/2026(UTC)Updated: 25/10/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.56%

47th percentile - higher than 47% of all known CVEs

Summary

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to version 1.4.0, the development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo.

Risk Assessment

The organization is exposed to unauthorized termination of active phone calls by an attacker, which can lead to service disruption, loss of customer trust, and potential misuse of API credentials for further attacks.

Recommendation

Immediately update Pipecat to version 1.4.0 or later, which includes a fix that removes unauthenticated access to the /ws WebSocket endpoint.

Other vulnerabilities in Pipecat

CVE-2025-62373Critical
Pipecat versions 0.0.41 through 0.0.93 contain a vulnerability in the optional LivekitFrameSerializer class, whose deserialize() method uses pickle.loads() on data received from WebSocket clients without validation. A malicious WebSocket client can send a crafted pickle payload to execute arbitrary code on the Pipecat server (RCE). Version 0.0.94 contains a fix.

Original NVD description (English source)

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS