A vulnerability has been found in Bokeh up to 3.8.1 and classified as critical. Impacted is an unknown function of the component Websocket Connection Handler. Performing a manipulation results in missing origin validation in websockets.
This vulnerability was named CVE-2026-21883. The attack may be initiated remotely. There is no available exploit.
The affected component should be upgraded.
