CVE-2026-85183
Critical · 9.3CVSS
9.3
EPSS
0.2%
Published
Sep 3, 2026
CISA due date
—
The record
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-59950 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-1385
- CVE-2026-57111 Permissive Cross-Origin Resource Sharing (CORS) in the REST API (helix-rest… CWE-1385
- CVE-2026-10054 In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes… CWE-1385
- CVE-2026-44211 Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. CWE-1385
- CVE-2026-44514 Kubetail is a real-time logging dashboard for Kubernetes. CWE-1385
- GHSA-5c57-rqjx-35g2 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability CWE-1385
- CVE-2026-34403 Nginx UI is a web user interface for the Nginx web server. CWE-1385
- CVE-2026-35589 nanobot is a personal AI assistant. CWE-1385