## Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-102682
- 公開日時: 2026-10-15T20:22:18.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-hqm2-cfx2-2vgh)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-hqm2-cfx2-2vgh

影響: pip:pipecat-ai >= 0.0.98, <= 1.5.0 → 1.6.0
Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is not built or supported as a production server. Exploitation therefore requires an operator to deliberately make the development runner reachable from an untrusted network, such as by setting --host 0.0…