CVE-2026-21883: Bokeh Incomplete Origin Validation in WebSockets
Summary
CVE-2026-21883: Bokeh server applications have Incomplete Origin Validation in WebSockets. Affects bokeh versions < 3.8.2. Fixed in 3.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bokeh is an open-source Python library that enables the creation of interactive visualizations for modern web browsers. It allows users to build complex dashboards and applications with rich visual elements. However, deployed Bokeh server instances are vulnerable to a specific issue related to WebSocket connections, which can lead to unauthorized access and data manipulation.
Vulnerability Detail
This vulnerability allows for Cross-Site WebSocket Hijacking (CSWSH) of a deployed Bokeh server instance. The flaw originates from the match_host function in the server's utility module, which incorrectly validates hostnames against an allowlist. An attacker can exploit this by registering a domain that matches the allowlist pattern, allowing them to initiate a WebSocket connection to the Bokeh server and interact with it on behalf of the victim. This could lead to unauthorized access to sensitive data or modifications to visualizations.
How To Fix
Minimum fixed version
3.8.2
This is the first release that contains the fix.
pip install --upgrade "bokeh==3.8.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. It is strongly recommended to update to the patched version as soon as possible.
Conclusion
The CVE-2026-21883 vulnerability in Bokeh poses a significant risk to deployed server instances due to incomplete origin validation in WebSockets. It is essential to update to version 3.8.2 or later to mitigate this risk. Users are encouraged to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for bokeh →
FAQ
Cross-Site WebSocket Hijacking (CSWSH) is a type of attack where an attacker can hijack a WebSocket connection to a server, allowing them to send and receive messages as if they were the legitimate user.
If you are running a version of Bokeh prior to 3.8.2, your server may be vulnerable. You can check your version by running pip show bokeh in your terminal.
While there are no workarounds available, it is crucial to prioritize updating to the patched version to protect your server from potential attacks.
No, this vulnerability only affects deployed Bokeh server instances and does not impact static HTML outputs or standalone embedded plots.
Vulert is a monitoring tool that alerts users in real-time for open-source vulnerabilities in their software. You can use the Vulert playground to check if your application is affected by this vulnerability without needing to sign up.
