Pipecat EUVD-2026-101601

Exploitation requires the operator to have deliberately exposed the built-in development runner beyond its default localhost binding - specifically via the --host 0.0.0.0 flag, a published/forwarded port, or a public tunnel (e.g. ngrok) placed in front of it WITHOUT any access controls. Against a default install the endpoints (/start, /daily, /daily-dialin-webhook) are only reachable from the local machine and cannot be attacked remotely. The principal limiting factors are therefore: localhost-only default binding, the need for operator misconfiguration to expose the service, and that the affected component is explicitly a development runner not intended for production (the authenticated dispatcher / managed runtime path is unaffected). No end-user interaction or attacker authentication is needed once the port is exposed.

This is a genuine-but-moderate issue best characterized as a secure-by-default framework shipping an insecure-if-misconfigured development tool. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L, base 5.6) correctly reflects the key tension: the endpoint is unauthenticated (PR:N) and network-reachable (AV:N), but AC:H captures that exploitation is not possible against a default install - the runner binds to localhost and only becomes reachable if an operator intentionally exposes it via --host 0.0.0.0, a published port, or an unauthenticated tunnel. All three impact metrics are Low, consistent with the real harm (quota/resource abuse and disclosure of a Daily room URL and join token) rather than code execution or full data compromise. No EPSS score was provided and the vulnerability is NOT in CISA KEV; exploitation status is 'no public exploit identified at time of analysis.' CWE-345 (insufficient verification of data authenticity) aligns with the unauthenticated-endpoint root cause. The vendor's own fix is notable and should temper severity: version 1.6.0 does NOT change endpoint behavior (unauthenticated access remains 'by design' for the dev runner) and instead adds a warning banner and documentation directing production users to an authenticated dispatcher. This signals the vendor views the flaw as operator misuse of a dev tool rather than a code defect. Net: real but low-priority for most organizations - meaningful only where teams have exposed the development runner to untrusted networks.

A developer runs the pipecat-ai development runner and, to test from another device or share a demo, launches it with --host 0.0.0.0 or behind a public tunnel without adding access controls. An unauthenticated attacker who discovers the exposed port sends POST requests to /start or /daily to spin up bot sessions and Daily rooms, burning the victim's compute and third-party Daily API quota and, depending on configuration, receiving a usable room URL and join token. No public exploit code is required - the endpoints are plain HTTP and need no authentication once reachable.