CVE-2026-102682

Executive Summary

CVE-2026-102682 is an unauthenticated endpoint exposure vulnerability in the Pipecat open-source Python framework (pipecat-ai) versions 0.0.98 through 1.6.0. The built-in development runner exposes endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms without authentication. Exploitation requires an operator to expose the runner to untrusted traffic via --host 0.0.0.0, a published port, or a tunnel without access controls. Impact includes local resource consumption, third-party quota exhaustion, and potential leakage of room URLs and join tokens.

Technical Analysis

The vulnerability resides in the Pipecat development runner, a convenience component intended strictly for local development. By design, the runner binds to localhost and does not enforce authentication on its HTTP endpoints. CWE-345 (Insufficient Verification of Data Authenticity) is the assigned weakness class, reflecting the absence of any authentication or origin-verification mechanism on the exposed endpoints.

The affected endpoints — /start, /daily, and /daily-dialin-webhook — allow an unauthenticated caller to initiate bot sessions and create Daily rooms. Because the runner is a development-only component, no authentication layer, session validation, or caller attestation is present. The attack surface is therefore not a software defect in the traditional sense but a configuration-dependent exposure: the endpoints function exactly as designed, but their unauthenticated nature becomes a security issue when the runner is reachable from untrusted networks.

The critical exposure vector is the --host 0.0.0.0 flag, which rebinds the runner from localhost to all network interfaces. Equivalent exposure occurs when the runner's port is published in a container configuration or when a tunnel (e.g., ngrok, Cloudflare Tunnel) forwards external traffic to the local runner without access controls. In these configurations, an attacker with network reachability can invoke the endpoints directly.

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (score 5.6) reflects network attackability but high attack complexity, because exploitation is contingent on the operator having misconfigured the runner's network binding. No privileges or user interaction are required once the endpoint is reachable. Confidentiality, integrity, and availability impacts are all Low, consistent with the limited scope of resource consumption and potential token disclosure rather than full system compromise.

Version 1.6.0 does not remove the endpoints, as their behavior remains by design. Instead, it introduces a prominent development-runner banner and documentation that clarifies the unauthenticated boundary and directs production deployments to an authenticated dispatcher or managed runtime.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance/target identification: An attacker scans internet-facing or internal network ranges for hosts exposing Pipecat development runner ports. Shodan or similar services can identify instances via characteristic HTML or headers when the runner is exposed. Targets are Pipecat deployments where the operator has used --host 0.0.0.0, published the container port, or established a tunnel without access controls.

2. Triggering the flaw: The attacker sends unauthenticated HTTP requests to the exposed endpoints /start, /daily, or /daily-dialin-webhook. Because no authentication is enforced, the runner processes the request and initiates the corresponding action — creating a bot session or a Daily room.

3. Payload/execution method: At the vulnerability-class level, the attacker simply issues requests to the unauthenticated endpoints. No credential bypass, injection, or memory corruption is involved; the endpoints are invoked as designed. The attacker does not need to craft a malicious payload beyond valid request syntax accepted by the runner.

4. Post-exploitation impact: Successful exploitation consumes local CPU, memory, and network resources through repeated bot session creation. It also consumes third-party quotas (e.g., Daily API usage) tied to the operator's account. Depending on configuration, the attacker may receive a room URL and join token in the response, enabling them to join or disrupt the created room. The attacker gains no direct code execution or data access beyond what the endpoints expose.

Impact Assessment

The primary business impact is resource exhaustion and third-party cost inflation. Repeated unauthenticated session creation can degrade the availability of the host running the development runner and consume paid quotas on the Daily platform, potentially generating unexpected billing. The CVSS subscores — Confidentiality: Low, Integrity: Low, Availability: Low — indicate limited but non-zero impact across all three dimensions. Confidentiality impact stems from potential exposure of room URLs and join tokens; integrity impact from unauthorized room creation; availability impact from resource consumption.

The blast radius is constrained to Pipecat deployments where the development runner has been exposed beyond localhost. Production deployments using an authenticated dispatcher or managed runtime are not affected. Because the runner is development-only, the population of exposed instances is likely small, but misconfigured tunnels and container port publishing are common operational pitfalls. No CISA KEV listing and no known exploit code or Nuclei template exist, indicating no active widespread exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Pipecat Development Runner Unauthenticated Endpoint Access
id: 7f3c9a12-4b8e-4d2a-9c1f-2a6d5e8b0f3a
status: experimental
description: Detects HTTP requests to Pipecat development runner endpoints that are unauthenticated by design.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102682
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_paths:
    cs-uri-stem:
      - '/start'
      - '/daily'
      - '/daily-dialin-webhook'
  condition: selection_paths
falsepositives:
  - Legitimate local development traffic from the same host
level: medium
tags:
  - attack.t1190
  - cve.2026.102682

YARA Rule

rule CVE_2026_102682_Pipecat_Runner_Exposure
{
    meta:
        description = "Detects Pipecat development runner exposure indicators"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102682"
        severity = "medium"

    strings:
        $s1 = "/daily-dialin-webhook" ascii nocase
        $s2 = "pipecat" ascii nocase
        $s3 = "/start" ascii nocase
        $s4 = "development runner" ascii nocase

    condition:
        (uint16(0) == 0x213C or true) and
        any of ($s1) or
        (2 of ($s2, $s3, $s4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102682 Pipecat Development Runner Unauthenticated Endpoint Access"; flow:established,to_server; content:"GET"; http_method; content:"/daily-dialin-webhook"; http_uri; nocase; sid:2026102682; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-102682; classtype:attempted-recon;)
alert http any any -> any any (msg:"CVE-2026-102682 Pipecat Development Runner Start Endpoint"; flow:established,to_server; content:"POST"; http_method; content:"/start"; http_uri; nocase; sid:2026102683; rev:1; metadata:created_at 2026_01_01, cve CVE_2026-102682; classtype:attempted-recon;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where http.request.method in ("GET", "POST") and
   http.request.uri in ("/start", "/daily", "/daily-dialin-webhook")]

Splunk SPL Query

index=web OR index=proxy
| search (uri_path="/start" OR uri_path="/daily" OR uri_path="/daily-dialin-webhook")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri_path, http_method, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="pipecat,cve-2026-102682,">
  <rule id="102682" level="7">
    <decoded_as>json</decoded_as>
    <field name="url">/start|/daily|/daily-dialin-webhook</field>
    <description>CVE-2026-102682: Pipecat development runner unauthenticated endpoint access</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_102682,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Do not expose the Pipecat development runner to untrusted networks. Remove any --host 0.0.0.0 binding. Unpublish container ports that map to the runner. Remove or restrict tunnels that forward external traffic to the runner, and place authentication or IP allowlisting in front of any exposed instance. Terminate runner instances when not actively in use.

2. Patch/upgrade steps: Upgrade pipecat-ai to version 1.6.0 or later, which adds a prominent development-runner banner and documentation clarifying the unauthenticated boundary. Note that endpoint behavior remains unchanged by design, so upgrading alone does not add authentication; operators must still avoid exposing the runner to untrusted traffic.

3. Long-term hardening: Adopt an authenticated dispatcher or managed runtime for production deployments, as directed by the 1.6.0 documentation. Enforce network segmentation so development components cannot be reached from untrusted networks. Implement monitoring for requests to /start, /daily, and /daily-dialin-webhook from external sources. Track third-party API quotas for anomalous consumption that may indicate abuse.

References

• NVD — CVE-2026-102682: https://nvd.nist.gov/vuln/detail/CVE-2026-102682
• Pipecat project documentation and release notes for version 1.6.0
• CWE-345 — Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
• CISA KEV Catalog: Not listed as of the date of this report
• No known public exploit code, PoC, or Nuclei template identified; no threat actor campaign attributed

No exploit-in-the-wild evidence or threat actor campaign has been identified for this CVE at the time of writing.