CVE-2026-21883

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. This issue is fixed in version 3.8.2.

• CWE-1385

• https://github.com/bokeh/bokeh/commit/cedd113b0e271b439dce768671685cf5f861812ePatch
• https://github.com/bokeh/bokeh/security/advisories/GHSA-793v-589g-574vExploit, Vendor Advisory
• https://aydinnyunus.github.io/2026/01/24/bokeh-websocket-hijacking-cve-2026-21883/Exploit, Mitigation, Third Party Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21878BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-21879Kanboard is project management software focused on Kanban me…6.1
• CVE-2026-2188A vulnerability was determined in UTT 进取 521G 3.1.1-190816. …7.3
• CVE-2026-21880Kanboard is project management software focused on Kanban me…5.3
• CVE-2026-21881Kanboard is project management software focused on Kanban me…9.1
• CVE-2026-21882theshit is a command-line utility that automatically detects…8.4
• CVE-2026-21884React Router is a router for React. In @remix-run/react vers…8.2
• CVE-2026-21885Miniflux 2 is an open source feed reader. Prior to version 2…6.5
• CVE-2026-21886OpenCTI is an open source platform for managing cyber threat…8.1
• CVE-2026-21887OpenCTI is an open source platform for managing cyber threat…7.7
• CVE-2026-21888NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-21889Weblate is a web based localization tool. Prior to 5.15.2, t…7.5