CVE-2026-54695

highCVSS 7.5covered by 1 sourcefirst seen 2026-07-09

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake in src/pipecat/runner/utils.py, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo. This issue is fixed in version 1.4.0.

⚡ Watch CVE-2026-54695

Get an email if CVE-2026-54695 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

highCVE-2026-54695: Pipecat is an open-source Python framework for building real-time voice and multimodal convers…nvd · 2026-07-09

External references

NVD record for CVE-2026-54695

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54695 status](https://www.csirts.com/badge/CVE-2026-54695)](https://www.csirts.com/cve/CVE-2026-54695)