What happened
Verified via NVD REST API (published 2026-10-14, CVSS 5.6, GHSA-hqm2-cfx2-2vgh). The development runner is unauthenticated by design and only reachable when operators misconfigure it to accept untrusted traffic.
Why it matters
Of the broader theme of dev-tool surfaces exposing unauthenticated agent control: in production voice-agent deployments, exposing the runner without an authenticated dispatcher would let outsiders burn bot sessions and third-party API quotas. Low blast radius (requires misconfig) but worth a hygiene note for Pipecat operators moving to production.
Attack vector
Unauthenticated caller hits the runner's control endpoints to spawn bot sessions/Daily rooms, consuming local resources and third-party quotas (CWE-345/770/862). The fix (1.6.0) is primarily a prominent dev-runner banner + documentation clarification — endpoint behavior remains by design.
Affected systems
pipecat-ai 0.0.98–<1.6.0
Mitigation
Upgrade to pipecat >= 1.6.0 for the warning banner/docs; never expose the dev runner (use an authenticated dispatcher or managed runtime in production).