CVE-2026-21883

Katalog CVE

CVSS 5.4 · Medium EPSS 0,18%

Kerentanan Missing Origin Validation in WebSockets pada bokeh. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. This issue is fixed in version 3.8.2.

Rincian

Terbit di NVD

8 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1385: Missing Origin Validation in WebSockets

EPSS (30 hari)

0,18% peluang dieksploitasi; lebih tinggi dari 6,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/bokeh/bokeh/security/advisories/GHSA-793v-589g-574v exploit · advisory vendor
• https://github.com/bokeh/bokeh/commit/cedd113b0e271b439dce768671685cf5f861812e patch
• https://aydinnyunus.github.io/2026/01/24/bokeh-websocket-hijacking-cve-2026-21883/ exploit · mitigasi · advisory pihak ketiga