CVE-2026-21883 - Bokeh Plugin
CVE-2026-21883
Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the attacker can interact with the Bokeh server on behalf of the victim, potentially accessing sensitive data, or modifying visualizations. This issue is fixed in version 3.8.2.
CVE-2026-21883
MEDIUM
CVSS 4.5
Published 2026-01-08
Updated 2026-01-23
AI Risk Moderate (50/100)
Active Exploit: No strong signal
Published Exploit: Public exploit references found
Priority: P4 Planned
Severity Band
MEDIUM
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Components
1
Reference Links
3
AI Risk Engine
Moderate (50/100)
Exploitability
Medium
Active Exploitation
No strong signal
Published Exploit Status
Public exploit references found
AI Context
Machine-generated threat intelligence
AI
Updated 16 days ago
AI enriched 16 days ago (2026-04-09 08:25 UTC)
Technical Summary
Bokeh is an interactive visualization library written in Python. In versions 3.8.1 and below, if a server is configured with an allowlist (e.g., dashboard.corp), an attacker can register a domain like dashboard.corp.attacker.com (or use a subdomain if applicable) and lure a victim to visit it. The malicious site can then initiate a WebSocket connection to the vulnerable Bokeh server. Since the Origin header (e.g., http://dashboard.corp.attacker.com/) matches the allowlist according to the flawed logic, the connection is accepted. Once connected, the…
Potential Impact
Severity is MEDIUM (CVSS 4.5). Depending on deployment context, affected components may be exposed to unauthorized actions or data integrity risk.
Exploitability Assessment
Exploitability is assessed as Medium based on published exploit references.
Primary risk drivers: published exploit references
Mitigation Recommendations
Validate affected product versions, prioritize patching, and monitor references for vendor remediation guidance. If immediate patching is not possible, apply compensating controls and limit exposure of vulnerable surfaces.
Detection & Monitoring
Track authentication anomalies, unexpected file writes, and suspicious plugin API activity around affected components.
Business Impact Lens
Prioritize remediation where affected components process customer data, admin sessions, or Internet-exposed workflows.
