CVE-2026-85183 in Taipy
Summary
by MITRE • 09/03/2026
Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed WebSocket connections to victim applications. Attackers can open socket.io sessions from arbitrary domains and invoke state variable modifications and action callbacks without CSRF protection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability in Taipy stems from an overly permissive Cross-Origin Resource Sharing configuration applied to its underlying Socket.IO server infrastructure. By setting the CORS origin policy to a wildcard value, typically represented as an asterisk or empty string depending on implementation specifics, and simultaneously enabling the credentials flag for preflight requests, the application inadvertently signals to web browsers that it trusts any originating domain to make authenticated requests. This configuration effectively disables the browser's same-origin security model regarding WebSocket connections initiated via JavaScript from arbitrary websites. In a standard secure deployment, server-side policies should restrict allowed origins to specific trusted domains or explicitly deny cross-origin access unless necessary for legitimate interoperability scenarios. The combination of wildcard origin acceptance and credential inclusion creates a severe misconfiguration that undermines the isolation boundaries intended by modern web security standards.
From an operational perspective, this flaw allows attackers to craft malicious web pages hosted on external domains that can establish persistent WebSocket connections to the victim application using stored session cookies or other authentication tokens. Because the server accepts these credentialed requests from any origin, it fails to validate whether the request originated from a trusted source. This lack of validation enables Cross-Site Request Forgery attacks against real-time features managed by Socket.IO. An attacker can inject malicious JavaScript into their own site that automatically connects to the victim's Taipy application upon user visit. Once connected, the attacker gains the ability to invoke server-side actions and modify state variables through socket events without triggering traditional CSRF protections designed for HTTP-based form submissions or API calls.
The impact of this vulnerability is significant as it allows unauthorized manipulation of application state and execution of privileged operations on behalf of authenticated users. Since Socket.IO often handles critical real-time updates, data synchronization, and user interactions in Taipy applications, an attacker can alter shared variables, trigger unintended actions, or disrupt the workflow for other connected clients. This compromises both confidentiality and integrity within the multi-user environment. Users who are logged into the vulnerable application may unknowingly perform state changes initiated by a third-party site they visited previously. The persistence of WebSocket connections also means that these attacks can be sustained over time rather than being limited to single-request exploits, potentially leading to prolonged unauthorized access or data corruption depending on the specific actions exposed through the socket interface.
Mitigation strategies must focus on tightening the CORS policy and implementing robust origin validation for all incoming Socket.IO connections. The server configuration should explicitly define a whitelist of allowed origins corresponding only to trusted domains rather than using wildcard values. Additionally, developers should ensure that sensitive operations performed via WebSocket events are protected with anti-CSRF tokens or similar mechanisms that verify the legitimacy of each request regardless of its source domain. It is also advisable to review the implementation of state variable modifications and action callbacks to ensure they require appropriate authentication checks beyond just the presence of a valid session cookie. Regular security audits focusing on real-time communication endpoints will help identify such misconfigurations before they can be exploited in production environments, aligning with industry best practices for securing WebSocket-based applications against cross-origin attacks.