EUVD-2026-101601

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation...

Missing Authorization

Overview pipecat-ai is an An open source framework for voice and multimodal assistants Affected versions of this package are vulnerable to Missing Authorization in pipecat.runner.run, the development runner exposes unauthenticated HTTP endpoints that can be reached over the network. An...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-102682 via pipecat-ai (>=0.0.98, <=1.4.0)

pipecat-ai PYPI version =0.0.98, =0.0.1, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.7.1.dev260608103499798499, =2.1.0 Source cves: CVE-2026-102682 Source advisory: OSV:GHSA-HQM2-CFX2-2VGH...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-102682 via pipecat-ai (>=0.0.98, <=1.4.0)

pipecat-ai PYPI version =0.0.98, =0.0.1, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.7.1.dev260608103499798499, =2.1.0 Source cves: CVE-2026-102682 Source advisory: SNYK:PYTHON-PIPECATAI-21246265...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-102682 via pipecat-ai (>=0.0.98, <=1.4.0)

pipecat-ai PYPI version =0.0.98, =0.0.1, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.7.1.dev260608103499798499, =2.1.0 Source cves: CVE-2026-102682 Source advisory: GHSA-HQM2-CFX2-2VGH...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682

The pipecat-ai Python framework (versions 0.0.98 to 1.6.0 ) contains a vulnerability where the built-in development runner exposes unauthenticated endpoints, including /start, /daily, and /daily-dialin-webhook. These endpoints allow unauthenticated callers to create bot sessions and Daily rooms ,...

CVE-2026-102682: Insufficient Verification of Data Authenticity

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

PT-2026-113941

Name of the Vulnerable Software and Affected Versions pipecat-ai versions 0.0.98 through 1.5.9 Description The built-in development runner of the pipecat-ai framework exposes unauthenticated endpoints, specifically '/start', '/daily', and '/daily-dialin-webhook', which allow the creation of bot...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (>=0.3.0, <=0.4.0) +11 more potentially affected by CVE-2026-54695 via pipecat-ai (>=0.0.85, <=1.3.0)

pipecat-ai PYPI version =0.0.85, =0.0.1, =0.3.0, =0.1.0, =0.0.5, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1.dev8325111910350515310, =2.0.1.dev260618103102525397 Source cves: CVE-2026-54695 Source advisory: OSV:PYSEC-2026-2878...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (0.4.0) +11 more potentially affected by CVE-2026-44716 via pipecat-ai (>=0.0.90, <=1.0.0)

pipecat-ai PYPI version =0.0.90, =0.0.1, =0.1.0, =0.0.5, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1.dev8325111910350515310, =1.7.1.dev260424103102100484 Source cves: CVE-2026-44716 Source advisory: OSV:PYSEC-2026-2877...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (>=0.3.0, <=0.4.0) +11 more potentially affected by CVE-2026-54695 via pipecat-ai (>=0.0.85, <=1.3.0)

pipecat-ai PYPI version =0.0.85, =0.0.1, =0.3.0, =0.1.0, =0.0.5, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1.dev8325111910350515310, =2.0.1.dev260618103102525397 Source cves: CVE-2026-54695 Source advisory: MEND:CVE-2026-54695...

connexity (0.0.8.3), connexity-pipecat (>=0.1.0, <=0.1.38) +6 more potentially affected by CVE-2025-62373 via pipecat-ai (>=0.0.48, <=0.0.92)

pipecat-ai PYPI version =0.0.48, =0.1.0, =0.1.0, =0.0.2, =0.1.1, =1.6.1.dev8325111910350515310, =1.7.1.dev260424103102100484 Source cves: CVE-2025-62373 Source advisory: OSV:PYSEC-2026-458...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (>=0.3.0, <=0.4.0) +11 more potentially affected by CVE-2026-54695 via pipecat-ai (>=0.0.85, <=1.3.0)

pipecat-ai PYPI version =0.0.85, =0.0.1, =0.3.0, =0.1.0, =0.0.5, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1.dev8325111910350515310, =2.0.1.dev260618103102525397 Source cves: CVE-2026-54695 Source advisory: SNYK:PYTHON-PIPECATAI-17394040...

calibrate-agent (>=0.0.1, <=0.0.77), nvidia-pipecat (>=0.3.0, <=0.4.0) +11 more potentially affected by CVE-2026-54695 via pipecat-ai (>=0.0.85, <=1.3.0)

pipecat-ai PYPI version =0.0.85, =0.0.1, =0.3.0, =0.1.0, =0.0.5, =0.0.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1.dev8325111910350515310, =2.0.1.dev260618103102525397 Source cves: CVE-2026-54695 Source advisory: OSV:GHSA-J8CV-X86Q-RJ85...

Missing Authorization

Overview pipecat-ai is an An open source framework for voice and multimodal assistants Affected versions of this package are vulnerable to Missing Authorization via the telephony WebSocket /ws and plain WebSocket /ws-client endpoints, which accepts attacker-controlled handshake messages containin...