CVE-2026-54695 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

🗓️ 09 Jul 2026 18:52:33Reported by GoogleType

osv🔗 osv.dev👁 1 Views

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without ...

Reporter	Title	Published	Views	Family All 15
ATTACKERKB	CVE-2026-54695	9 Jul 202618:52	–	attackerkb
Circl	CVE-2026-54695	17 Jun 202614:39	–	circl
CVE	CVE-2026-54695	9 Jul 202618:52	–	cve
Cvelist	CVE-2026-54695 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID	9 Jul 202618:52	–	cvelist
EUVD	EUVD-2026-42673	9 Jul 202618:52	–	euvd
Github Security Blog	Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID	18 Jun 202615:05	–	github
NVD	CVE-2026-54695	9 Jul 202619:17	–	nvd
OSV	GHSA-J8CV-X86Q-RJ85 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID	18 Jun 202615:05	–	osv
OSV	PYSEC-2026-2878 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID	13 Jul 202615:46	–	osv
Positive Technologies	PT-2026-50727	18 Jun 202600:00	–	ptsecurity

Source	Link
github	www.github.com/pipecat-ai/pipecat/releases/tag/v1.4.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54695.json
github	www.github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54695
github	www.github.com/pipecat-ai/pipecat/commit/3032da53434c5ef01d368654b3551cf21c50dec9
github	www.github.com/pipecat-ai/pipecat/commit/88440676996e5e548e1aecea5d565e1c48ccf6fa
github	www.github.com/pipecat-ai/pipecat/pull/4660

13 Jul 2026 16:42Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

EPSS0.00327