PyPI/pipecat-ai CVE-2026-54695: high 7.5, EPSS 0.56%

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Action: Upgrade pipecat-ai to 1.4.0 or later.

pip install pipecat-ai==1.4.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2878
• https://github.com/pipecat-ai/pipecat/security/advisories/GHSA-j8cv-x86q-rj85
• https://github.com/pipecat-ai/pipecat/pull/4660
• https://github.com/pipecat-ai/pipecat
• https://pypi.org/project/pipecat-ai
• https://github.com/advisories/GHSA-j8cv-x86q-rj85
• https://nvd.nist.gov/vuln/detail/CVE-2026-54695

CVE-2026-54695 · published 2026-07-13T15:46:20.935605Z · modified 2026-07-13T16:32:57.452938993Z · JSON