CVE-2026-85183 is a cross site WebSocket hijacking flaw in Taipy through 4.1.1 (CVSS 9.3, critical). Its socket.io server allows any origin with credentials. I could not confirm a fixed version, so check the project before relying on one. The sections below cover affected versions, how to check your exposure and what to do first.
What's affected
The record says Taipy configures its socket.io server with a wildcard CORS origin and the credential flag on. Any web page can then open a credentialed WebSocket to a victim's Taipy application. The weakness is CWE-1385, missing origin validation in WebSockets.
VulnCheck lists Taipy up to 4.1.1. The record says an attacker can change state variables and trigger action callbacks without CSRF protection. No fixed version appears in the record or the pages I could read, so check the Taipy repository and the linked issue. The record is not in the CISA KEV catalog.
How to check if you're exposed
List the version in your environment.
pip show taipy
If it is 4.1.1 or lower, treat it as affected. Then ask whether any Taipy application is used by people who browse other sites while logged in, since the attack runs from a page the victim opens.
What to do now
- Find every Taipy application and note its version.
- Check the Taipy repository and issue 2890 for a fixed release, and upgrade when one exists.
- Put the app behind authentication and a reverse proxy that enforces an allowed origin list.
- Do not run Taipy apps with sensitive actions on networks where users browse the open web, until fixed.
- Rerun a dependency scan after updating.
Why it matters
Browsers let a page open a WebSocket to any host. The server has to decide whether to accept it, usually by checking the Origin header. A wildcard allows everything, and with credentials on, the victim's own login rides along.
This is the same idea as CSRF, moved to a long lived connection. Pinning allowed origins is the standard fix.
Quick check
Is there a fixed version?
I could not confirm one. The record only says through 4.1.1, so check the project issue and release notes.
Sources
Last reviewed: 19 October 2026.
