CVE-2026-21883 Bokeh server applications have Incomplete Origin Validation in WebSockets
Attackers can bypass WebSocket origin checks to access or modify Bokeh server data if an allowlist is configured.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-21883?
CVE-2026-21883 is a medium-severity missing authorization vulnerability in bokeh, published on 8 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. This issue is fixed in version 3.8.2.
Weakness: CWE-1385
Which versions are affected by CVE-2026-21883?
3 open source packages ship an affected version, including bokeh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
bokeh PyPI | All versions | 3.8.2 |
bokeh PyPI | All versions | 3.8.2 |
bokeh PyPI | All versions | 3.8.2 |
Products include Bokeh Bokeh.
How do I fix CVE-2026-21883?
Upgrade bokeh to 3.8.2 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-21883 being exploited?
There is no known exploitation of CVE-2026-21883 in the wild and no public exploit code.
Sources
Also known as GHSA-793v-589g-574v, PYSEC-2026-1223.