Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

影響: pip:pipecat-ai >= 0.0.98, <= 1.5.0 → 1.6.0

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is not built or supported as a production server. Exploitation therefore requires an operator to deliberately make the development runner reachable from an untrusted network, such as by setting --host 0.0…

GitHub Advisory Databaseで読む

2026/10/16 05:22、GitHub Advisory Databaseが「Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-102682。