Is CVE-2026-85183 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85183 being exploited in the wild.

How severe is CVE-2026-85183?

Critical severity, with a CVSS score of 9.3, published 3 September 2026.

Is there a fix for CVE-2026-85183?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85183 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85183?

Check whether you run Avaiga Taipy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85183: Avaiga Taipy socket.io CORS misconfiguration

CVE-2026-85183 · Severity: critical · CVSS 9.3 · Published 2026-09-03

Taipy is a framework for building production web applications with data and AI algorithms. Due to improper Cross-Origin Resource Sharing (CORS) configuration on its socket.io server, an attacker can open malicious web pages that establish credentialed WebSocket connections to Taipy applications running on victim machines. This allows attackers to modify application state, invoke backend functions, and potentially compromise sensitive data or application integrity without the user's knowledge.

Quick answers

Is CVE-2026-85183 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85183 being exploited in the wild.
How severe is CVE-2026-85183?: Critical severity, with a CVSS score of 9.3, published 3 September 2026.
Which products and versions are affected?: Avaiga Taipy 4.1.1 and prior.
Is there a fix for CVE-2026-85183?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85183 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85183?: Check whether you run Avaiga Taipy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Taipy's socket.io server is configured with a wildcard CORS origin (*) and the credential flag enabled, a misconfiguration that violates browser same-origin policy protections. This allows any arbitrary web page to establish authenticated WebSocket connections to Taipy applications. An attacker can craft a malicious website that, when visited by a user running a Taipy application, silently connects to the local or remote Taipy instance and invokes state variable modifications and action callbacks. The vulnerability requires no CSRF tokens or additional authentication, as the browser automatically includes credentials in cross-origin socket.io requests. No authentication bypass is required if the Taipy application itself lacks proper access controls.

Affected products

Avaiga Taipy 4.1.1 and prior

Timeline

2026-09-03: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.