A critical (CVSS 9.3) misconfiguration in Avaiga's Taipy lets any web page open credentialed socket.io connections to a victim's Taipy application and drive its state.
What Is It
Taipy configures its socket.io server with a wildcard CORS origin while leaving the credentials flag enabled. That combination permits any origin to establish credentialed WebSocket connections to a victim application. An attacker who gets a user to visit a malicious page can open socket.io sessions from an arbitrary domain and invoke state variable modifications and action callbacks, with no CSRF protection standing in the way.
The issue is classified as CWE-1385 (Missing Origin Validation in WebSockets). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, network reachable, low complexity, no privileges required, but dependent on passive user interaction. Scope is marked changed, and the CVSS 4.0 assessment likewise records high confidentiality and integrity impact to both the vulnerable component and downstream systems.
Why It Matters
Taipy applications frequently front data pipelines and business logic, so callback invocation is not a cosmetic problem: an attacker reaching action callbacks can read and alter application state that the victim's session is authorized to touch. The attack requires no credentials of the attacker's own; it borrows the victim's, which is what makes the wildcard-plus-credentials pairing so severe.
CISA's SSVC assessment for this CVE records exploitation as proof-of-concept, automatable as no, and technical impact as total. There is no CISA KEV entry for CVE-2026-85183, so active exploitation in the wild is not confirmed at this time.
What's Vulnerable
- Vendor/product: Avaiga Taipy (
pkg:pypi/taipy) - Affected versions: all versions up to and including 4.1.1
- Component: the socket.io server configuration in
taipy/gui/server.py
No CPE configurations have been published for this record yet.
Patch Status
The supplied NVD record does not identify a fixed version or vendor patch, and no CISA KEV required action or remediation deadline applies. The issue is tracked publicly in the Taipy repository as issue #2890; operators running 4.1.1 or earlier should follow that issue and the VulnCheck advisory for fix availability.
Sources
- NVD, CVE-2026-85183: https://nvd.nist.gov/vuln/detail/CVE-2026-85183
- VulnCheck Advisory; Taipy through 4.1.1 Cross-Site WebSocket Hijacking via Wildcard socket.io CORS: https://www.vulncheck.com/advisories/taipy-through-4.1.1-cross-site-websocket-hijacking-via-wildcard-socket-io-cors
- Avaiga/taipy Issue #2890: https://github.com/Avaiga/taipy/issues/2890
- Avaiga/taipy source,
taipy/gui/server.py@ 4.1.1: https://github.com/Avaiga/taipy/blob/4.1.1/taipy/gui/server.py - Avaiga/taipy repository: https://github.com/Avaiga/taipy