CVE-2026-54695: Pipecat Unauthenticated WebSocket Call Control Vulnerability

Technical summary

The vulnerability exists in pipecat's development runner, which registers an unauthenticated /ws WebSocket endpoint for telephony testing. The endpoint accepts Twilio stream-start handshakes and extracts an attacker-controlled callSid parameter from src/pipecat/runner/utils.py, passing it directly to TwilioFrameSerializer. This serializer then uses the server operator's Twilio REST API credentials to issue authenticated hang-up requests. Equivalent flaws exist for Telnyx and Plivo call-control sinks. No authentication or authorization checks gate access to this endpoint or validate the origin of the callSid.

Business impact

Organizations running Pipecat for voice agent development or testing are exposed to call disruption and unauthorized call termination. Attackers can terminate active calls without authentication, degrading service availability and potentially causing financial losses if revenue-generating or customer-critical calls are interrupted. The vulnerability requires network access to the development runner, limiting the risk to internal deployments or internet-exposed testing instances, but the use of legitimate operator credentials to perform actions means the root cause is difficult to detect or audit after the fact.

Affected systems

Pipecat versions prior to 1.4.0 are affected. The vulnerability impacts deployments using the development runner with Twilio, Telnyx, or Plivo integrations. Risk is highest for internet-exposed development or staging environments, but also applies to internal networks if threat actors gain access. End-users of Pipecat-built applications are not directly at risk unless the application itself runs the vulnerable development runner in production.

Exploitability

The attack has a network vector (AV:N) with high complexity (AC:H), meaning network access is required but additional conditions must be present (likely knowledge of the endpoint and valid telephony provider setup). No authentication is required (PR:N, UI:N), and no user interaction is needed. The impact crosses security boundaries (S:C), meaning impact can affect resources beyond the immediate application. The attack requires the operator to have active calls and valid telephony credentials, but exploitation itself does not require advanced tooling—a simple WebSocket client suffices.

Remediation

Upgrade to Pipecat version 1.4.0 or later immediately. The fix adds authentication and authorization checks to the /ws WebSocket endpoint, preventing unauthenticated access. Operators running versions prior to 1.4.0 should immediately take the development runner offline if it is internet-exposed, or restrict network access to trusted internal networks only. Review telephony provider logs (Twilio, Telnyx, Plivo) for unauthorized call-control API calls and any unexpected call terminations during the vulnerable period.

Patch guidance

Pipecat 1.4.0 or later resolves this issue. Users should upgrade via their Python package manager (e.g., pip install --upgrade pipecat). Verify the installed version with pip show pipecat or check the Pipecat GitHub releases page for 1.4.0 or subsequent releases. If automated dependency updates are enabled, ensure they are configured to pull version 1.4.0 or later. Test the development runner after upgrade to confirm the /ws endpoint is properly gated and rejects unauthenticated connections.

Detection guidance

Monitor for unauthenticated WebSocket connections to /ws endpoints on systems running Pipecat. Check application and proxy logs for WebSocket handshakes lacking authentication headers or Bearer tokens. Query telephony provider audit logs (Twilio, Telnyx, Plivo) for unexpected or unauthorized call termination API calls, especially if they originate from internal IP ranges or service accounts associated with development runners. Network intrusion detection systems (IDS) may flag repeated WebSocket handshake attempts to development endpoints as potential reconnaissance. Review source code and deployment configurations to identify where Pipecat development runners are running and whether they are exposed to untrusted networks.

Why prioritize this

This vulnerability scores 7.5 (HIGH) due to its network attack surface, lack of authentication, and impact on service availability. While the attack has high complexity and does not affect confidentiality, the ability to disrupt telephony services using legitimate operator credentials makes it a material availability risk. Prioritize remediation for any Pipecat instances that are internet-exposed or run in shared environments. Development-only deployments behind strict network controls are lower priority but should still be upgraded during routine maintenance windows.

Risk score, explained

CVSS 3.1 score of 7.5 reflects: network-accessible endpoint (AV:N) with no authentication required (PR:N), high attack complexity due to prerequisite conditions (AC:H), no user interaction required (UI:N), scope change across security boundaries (S:C), no confidentiality impact (C:N), limited integrity impact (I:L, representing unauthorized actions), and high availability impact (A:H, call disruption). The score appropriately captures the severity of unauthenticated call control but is tempered by the requirement for a valid telephony setup and the attacker's inability to read sensitive data.

Frequently asked questions