CVE-2026-54695 Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

What is CVE-2026-54695?

CVE-2026-54695 is a high-severity missing authorization vulnerability in pipecat-ai pipecat, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

Weakness: CWE-862

Which versions are affected by CVE-2026-54695?

3 open source packages ship an affected version, including pipecat-ai. It affects 1 product.

Products include Pipecat Pipecat.

How do I fix CVE-2026-54695?

Upgrade pipecat-ai to 1.4.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-54695 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54695 exists.

Other vulnerabilities in pipecat-ai pipecat

• CVE-2025-62373 Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer Critical 9.8
• CVE-2026-44716 Pipecat: Path Traversal in Pipecat Runner `/files` Endpoint — Arbitrary File Read via `%2F`-Encoded Separator High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j8cv-x86q-rj85, PYSEC-2026-2878.