AUGUST 24, 2026
Live Feed
Back to database
Case File

CVE-2026-54695

HIGH · CVSS 7.5 EPSS 0.37% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-09 · Last synced 2026-08-08

CyberRota Analysis

AI-Generated

The Pipecat framework prior to version 1.4.0 contains a vulnerability that allows unauthenticated access to a WebSocket endpoint, enabling attackers to exploit the system by sending a malicious callSid during telephony testing. This could lead to unauthorized control over call hang-ups using the server operator's credentials, posing a significant risk to any organization utilizing this framework for voice or multimodal applications. Developers and system administrators using Pipecat should prioritize upgrading to version 1.4.0 to mitigate this high-severity risk.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54695
Severity
HIGH
CVSS
7.5
EPSS
0.37%

Original NVD Description

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

Related CVEs

Other vulnerabilities affecting the same vendor(s)