GHSA-hqm2-cfx2-2vgh: Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Summary

Pipecat's built-in development runner exposes endpoints, including /start, /daily and /daily-dialin-webhook, that create bot sessions and Daily rooms without authentication. Exploitation requires an operator to make the runner reachable from an untrusted network, such as by setting --host 0.0.0.0 or publishing its port. Pipecat 1.6.0 adds a startup banner and documentation stating the runner must not be exposed to untrusted traffic.

Mitigation

Pipecat 1.6.0 documents and surfaces the intended security boundary of the development runner; the unauthenticated behavior remains by design. Users must not expose the runner directly to untrusted networks, and production deployments require an authenticated dispatcher or managed runtime.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• pipecat-aiPyPILLM dependency since 2024-05-13 · 1 tracked dependent

Related items

• MediumGHSA-84m7-p3x7-pcfv: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionSimilar attack · GitHub Advisory Database
• MediumCVE-2026-109311: vLLM audio upload heap overflow via FFmpeg IAMF parserSimilar attack · NVD/CVE Database
• MediumCVE-2026-108748: Quarkus LangChain4j memory exhaustion in chat-scopes WebSocketSimilar attack · NVD/CVE Database
• HighHermes Agent - Pre-Authentication Disk ConsumptionSimilar attack · Tenable Research Advisories
• MediumHermes Agent - Pre-Authentication Memory ExhaustionSimilar attack · Tenable Research Advisories