Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

影響: pip:pipecat-ai >= 0.0.98, <= 1.5.0 → 1.6.0

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is not built or supported as a production server. Exploitation therefore requires an operator to deliberately make the development runner reachable from an untrusted network, such as by setting --host 0.0…

GitHub Advisory Database에서 읽기

2026. 10. 16. 오전 05:22, GitHub Advisory Database에서 "Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-102682.