CVE-2026-21883: Bokeh Python Library CSRF Vulnerability

CVE-2026-21883 Overview

CVE-2026-21883 is an Authorization Bypass vulnerability affecting Bokeh, an interactive visualization library written in Python. The vulnerability exists in the WebSocket origin validation logic used by Bokeh servers configured with an allowlist. Due to flawed origin matching logic, an attacker can bypass the allowlist protection by registering a domain that contains the allowlisted domain as a prefix (e.g., dashboard.corp.attacker.com when dashboard.corp is allowlisted). This allows malicious sites to establish WebSocket connections to vulnerable Bokeh servers, enabling cross-site WebSocket hijacking attacks.

Critical Impact

Attackers can interact with Bokeh servers on behalf of victims, potentially accessing sensitive data or modifying visualizations through cross-site WebSocket hijacking.

Affected Products

• Bokeh versions 3.8.1 and below
• Bokeh servers configured with origin allowlists

Discovery Timeline

• 2026-01-08 - CVE CVE-2026-21883 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21883

Vulnerability Analysis

The vulnerability stems from improper origin validation in Bokeh's WebSocket handling code. When a Bokeh server is configured with an origin allowlist to restrict which domains can establish WebSocket connections, the validation logic incorrectly matches origins that merely contain the allowlisted domain as a substring or prefix, rather than requiring an exact match.

For example, if an administrator configures the server to only accept connections from dashboard.corp, the flawed logic would also accept connections from dashboard.corp.attacker.com because the origin header starts with the allowlisted value. This creates a significant security gap that attackers can exploit through social engineering.

The attack requires user interaction—a victim must be lured to visit a malicious website controlled by the attacker. Once there, the attacker's JavaScript code can initiate a WebSocket connection to the vulnerable Bokeh server. Since the browser automatically includes the Origin header and the victim may be authenticated to the Bokeh server, this enables unauthorized access to server functionality.

Root Cause

The root cause is CWE-1385: Improper Origin Validation in WebSockets. The origin validation function uses substring matching or prefix matching instead of exact domain matching with proper boundary checking. This allows attacker-controlled domains that incorporate the allowlisted domain name to bypass the security control entirely.

Attack Vector

The attack is network-based and requires user interaction. An attacker must first register a domain that incorporates the victim organization's allowlisted domain (e.g., registering dashboard.corp.attacker.com when dashboard.corp is allowlisted). The attacker then hosts malicious content on this domain and lures victims to visit it through phishing or other social engineering techniques.

Once a victim visits the malicious site, client-side JavaScript establishes a WebSocket connection to the target Bokeh server. The server's flawed origin validation accepts the connection because the Origin header (http://dashboard.corp.attacker.com/) matches the allowlist according to the vulnerable logic. The attacker can then send commands to the Bokeh server through the established WebSocket connection, operating with whatever privileges the victim has.

The vulnerability mechanism works as follows: The Bokeh server receives a WebSocket upgrade request with an Origin header from the attacker's domain. The validation function checks if the allowlisted domain appears in the Origin header, but fails to properly validate domain boundaries. As a result, domains ending with additional components pass the check, enabling the bypass.

For technical implementation details, refer to the GitHub Security Advisory and the fix commit.

Detection Methods for CVE-2026-21883

Indicators of Compromise

• WebSocket connections from unexpected origin domains that partially match allowlisted domains
• Origin headers containing allowlisted domain names followed by additional domain components
• Unusual WebSocket traffic patterns from domains resembling internal or trusted domains
• Log entries showing accepted connections from origins like alloweddomain.attacker.com

Detection Strategies

• Review WebSocket access logs for origin headers that contain allowlisted domains but include additional subdomain or domain components
• Monitor for newly registered domains that incorporate your organization's domain names
• Implement additional server-side logging to capture full Origin headers for WebSocket connections
• Analyze network traffic for WebSocket connections initiated from untrusted external sources

Monitoring Recommendations

• Enable verbose logging on Bokeh servers to capture Origin headers for all WebSocket connection attempts
• Set up alerts for WebSocket connections from origins that partially match but don't exactly match allowlisted domains
• Monitor DNS registrations for domain names that could be used to bypass your origin allowlists
• Implement network-level monitoring for outbound WebSocket connections from internal systems

How to Mitigate CVE-2026-21883

Immediate Actions Required

• Upgrade Bokeh to version 3.8.2 or later immediately
• Audit existing origin allowlist configurations for overly permissive patterns
• Review recent WebSocket connection logs for potential exploitation attempts
• Consider implementing additional authentication layers for sensitive Bokeh applications

Patch Information

The vulnerability has been fixed in Bokeh version 3.8.2. The fix improves the origin validation logic to properly check domain boundaries, ensuring that only exact matches or properly validated subdomains are accepted. The patch is available through the standard Bokeh distribution channels.

For detailed information about the fix, see the GitHub commit and the GitHub Security Advisory.

Workarounds

• Place Bokeh servers behind a reverse proxy with additional origin validation that performs strict domain matching
• Implement network-level restrictions to limit which external domains can establish connections to Bokeh servers
• Use additional authentication mechanisms such as tokens or session validation for WebSocket connections
• If possible, restrict Bokeh server access to internal networks only until the patch can be applied

# Configuration example
# Upgrade Bokeh to patched version
pip install --upgrade bokeh>=3.8.2

# Verify installed version
pip show bokeh | grep Version