CVE-2026-21883
Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. This issue is fixed in version 3.8.2.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.5
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U
- EPSS probability
- 0.18%
- CWE
- CWE-1385
- Published
- 2026-01-08
- Last modified
- 2026-03-12
Affected products
- bokeh bokeh
Weakness type
Related vulnerabilities
- CVE-2026-88061 — career-ops: Local dashboard API accepted cross-origin and non-loopback requests, allowing unauthenticated command execution
- CVE-2026-85183 — Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS
- CVE-2026-15580 — PassPortal browser extension: vault token disclosure via unvalidated postMessage
- CVE-2026-59950 — MCP Python SDK: WebSocket server transport does not support Host/Origin validation
- CVE-2026-57111 — Apache Helix REST: Permissive CORS Configuration in REST API Allows Unrestricted Cross-Origin
- CVE-2026-59804 — Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
- CVE-2026-10054 — In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged...
- CVE-2026-44211 — Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability