CVE-2026-102682: CWE-345: Insufficient Verification of Data Authenticity in pipecat-ai pipecat

The pipecat-ai Python framework for conversational agents has a vulnerability (CVE-2026-102682) in versions >=0.0.98 and <1.6.0 where its built-in development runner exposes unauthenticated endpoints (/start, /daily, /daily-dialin-webhook). These endpoints allow unauthenticated callers to create bot sessions and Daily rooms, potentially consuming local resources and third-party quotas, and may provide room URLs and join tokens depending on configuration. The runner binds to localhost by default, so exploitation requires intentional exposure to untrusted traffic via --host 0.0.0.0, port publishing, or tunnels without access controls. Version 1.6.0 introduces a prominent banner and documentation clarifying these endpoints are unauthenticated and intended only for development, recommending authenticated dispatchers or managed runtimes for production, thus addressing the issue.

An unauthenticated attacker who can access the exposed development runner endpoints may consume local resources and third-party service quotas and potentially obtain room URLs and join tokens, leading to unauthorized resource usage and possible unauthorized access to communication sessions. However, exploitation requires deliberate exposure of the localhost-bound runner to untrusted networks, limiting the risk to misconfigured deployments.

Upgrade to pipecat version 1.6.0 or later, which adds clear warnings and documentation about the unauthenticated nature of the development runner endpoints and directs production deployments to use authenticated dispatchers or managed runtimes. Avoid exposing the development runner to untrusted networks by not using --host 0.0.0.0 or publishing the port without access controls. The issue is fixed by design in version 1.6.0.