CVE-2026-59723: Cline missing Origin check on Hub

CISO Take

Cline's local Hub dashboard server (started via `cline dashboard`) accepts WebSocket connections on its /browser endpoint without validating the Origin header, and when the optional ROOM_SECRET is left unset — the default for local 127.0.0.1 binds — any website a developer visits in the same browser can open a cross-site WebSocket connection to the Hub and send desktopCommand frames. This matters because it turns an ordinary browsing session into a foothold on a developer machine: the attacker can read workspace state, rewrite MCP and provider settings, and — if a provider/model is already configured, which is the normal state for an actively-used coding agent — trigger arbitrary command execution, all at CVSS 8.8 with no privileges required (PR:N) and only one click of user interaction. EPSS is low (0.145%, though still in roughly the top 4% of all scored CVEs) and there is no public exploit, Nuclei template, or CISA KEV listing, so this is not under active mass exploitation today, but the prerequisite is trivial and common: a developer running Cline Hub while browsing the web. Patch every workstation and CI runner running the Hub/dashboard to Cline 3.0.30 immediately; until patched, explicitly set ROOM_SECRET, avoid leaving `cline dashboard` running while browsing untrusted sites, and watch for unexpected WebSocket connections to the Hub's local port or unexplained changes to MCP/provider configuration files.

Sources: NVD EPSS GitHub Advisory CISA KEV ATLAS github.com

What is the risk?

High severity (CVSS 8.8) due to the combination of no authentication requirement when ROOM_SECRET is unset, low attack complexity, and full compromise of confidentiality, integrity and availability once exploited. The mitigating factors are that exploitation requires user interaction (visiting a malicious or compromised page while the Hub is running) and network adjacency framing (AV:A) rather than pure remote/unauthenticated internet exposure — this is a local-service-reachable-from-browser class of bug (cross-site WebSocket hijacking), not an internet-facing RCE. No public exploit code, no Nuclei template, and no CISA KEV listing exist yet, and EPSS is low in absolute terms, so near-term mass exploitation is unlikely. However, the developer population running AI coding agents locally is growing fast, the vulnerability class (missing Origin validation on a local WebSocket server) is well understood and easy to weaponize once researchers or attackers focus on it, and the impact — arbitrary command execution on a developer's machine with source code and credentials in scope — is severe enough to warrant prompt patching rather than a 'wait and see' posture.

How does the attack unfold?

Initial exposure

A developer runs `cline dashboard`, starting the Cline Hub WebSocket server on 127.0.0.1 with ROOM_SECRET unset by default, and later browses the web while it remains active.

AML.T0078

Cross-origin connection

Malicious JavaScript on a visited page opens a WebSocket connection to the Hub's /browser endpoint, which accepts it because Origin headers are never validated.

AML.T0084

Configuration and state manipulation

The attacker sends desktopCommand frames to read workspace state and rewrite MCP and provider settings, establishing conditions for further abuse.

AML.T0081

Command execution impact

With a provider/model already configured, the attacker triggers command execution through the agent, achieving code execution on the developer's machine.

AML.T0050

Initial exposure

A developer runs `cline dashboard`, starting the Cline Hub WebSocket server on 127.0.0.1 with ROOM_SECRET unset by default, and later browses the web while it remains active.

AML.T0078

Cross-origin connection

Malicious JavaScript on a visited page opens a WebSocket connection to the Hub's /browser endpoint, which accepts it because Origin headers are never validated.

AML.T0084

Configuration and state manipulation

The attacker sends desktopCommand frames to read workspace state and rewrite MCP and provider settings, establishing conditions for further abuse.

AML.T0081

Command execution impact

With a provider/model already configured, the attacker triggers command execution through the agent, achieving code execution on the developer's machine.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Cline	npm	—	No patch
66.7K 2 dependents Pushed 3d ago 33% patched ~0d to patch Full package profile →

Do you use Cline? You're affected.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 15% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Adjacent

AC Low

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade Cline to version 3.0.30 or later on every workstation, laptop, and CI/build agent that runs cline dashboard — this is the definitive fix (Origin validation + ROOM_SECRET enforcement). 2) Until patched, explicitly set a strong ROOM_SECRET environment variable before starting the Hub rather than relying on the default unset behavior for local binds. 3) Avoid leaving the Cline Hub dashboard running in the background while browsing the general web; treat it like any other locally-exposed dev server. 4) Where feasible, block or firewall the Hub's local port from being reached by browser processes, or run it in an isolated network namespace/container. 5) Detection: monitor for unexpected WebSocket handshakes to the Hub's local port lacking an expected Origin, unauthorized/unexpected changes to MCP or provider configuration files, and unexplained command executions initiated by the Cline agent outside of an active developer session. 6) Audit which provider/model configurations are currently wired into Cline instances across the fleet, since a configured provider/model is the precondition for the command-execution impact.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Agent Plugin AML.T0050 - Command and Scripting Interpreter AML.T0078 - Drive-by Compromise AML.T0081 - Modify AI Agent Configuration AML.T0084 - Discover AI Agent Configuration AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4 - AI system security controls

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM06 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-59723?

Cline's local Hub dashboard server (started via `cline dashboard`) accepts WebSocket connections on its /browser endpoint without validating the Origin header, and when the optional ROOM_SECRET is left unset — the default for local 127.0.0.1 binds — any website a developer visits in the same browser can open a cross-site WebSocket connection to the Hub and send desktopCommand frames. This matters because it turns an ordinary browsing session into a foothold on a developer machine: the attacker can read workspace state, rewrite MCP and provider settings, and — if a provider/model is already configured, which is the normal state for an actively-used coding agent — trigger arbitrary command execution, all at CVSS 8.8 with no privileges required (PR:N) and only one click of user interaction. EPSS is low (0.145%, though still in roughly the top 4% of all scored CVEs) and there is no public exploit, Nuclei template, or CISA KEV listing, so this is not under active mass exploitation today, but the prerequisite is trivial and common: a developer running Cline Hub while browsing the web. Patch every workstation and CI runner running the Hub/dashboard to Cline 3.0.30 immediately; until patched, explicitly set ROOM_SECRET, avoid leaving `cline dashboard` running while browsing untrusted sites, and watch for unexpected WebSocket connections to the Hub's local port or unexplained changes to MCP/provider configuration files.

Is CVE-2026-59723 actively exploited?

No confirmed active exploitation of CVE-2026-59723 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59723?

1) Upgrade Cline to version 3.0.30 or later on every workstation, laptop, and CI/build agent that runs `cline dashboard` — this is the definitive fix (Origin validation + ROOM_SECRET enforcement). 2) Until patched, explicitly set a strong ROOM_SECRET environment variable before starting the Hub rather than relying on the default unset behavior for local binds. 3) Avoid leaving the Cline Hub dashboard running in the background while browsing the general web; treat it like any other locally-exposed dev server. 4) Where feasible, block or firewall the Hub's local port from being reached by browser processes, or run it in an isolated network namespace/container. 5) Detection: monitor for unexpected WebSocket handshakes to the Hub's local port lacking an expected Origin, unauthorized/unexpected changes to MCP or provider configuration files, and unexplained command executions initiated by the Cline agent outside of an active developer session. 6) Audit which provider/model configurations are currently wired into Cline instances across the fleet, since a configured provider/model is the precondition for the command-execution impact.

What systems are affected by CVE-2026-59723?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, local AI coding agents / developer tooling, MCP (Model Context Protocol) integrations.

What is the CVSS score for CVE-2026-59723?

CVE-2026-59723 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

agent frameworkslocal AI coding agents / developer toolingMCP (Model Context Protocol) integrations

MITRE ATLAS Techniques

AML.T0050 Command and Scripting Interpreter

AML.T0078 Drive-by Compromise

AML.T0081 Modify AI Agent Configuration

AML.T0084 Discover AI Agent Configuration

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Exploitation Scenario

A developer has Cline installed and runs `cline dashboard` to monitor agent activity, leaving ROOM_SECRET unset (the default for a localhost bind). While the Hub is running, the developer visits a compromised blog, a malicious ad, or a link sent via phishing/social engineering. Embedded JavaScript on that page opens a WebSocket connection to `ws://127.0.0.1:<hub-port>/browser` — the browser permits this because Cline's Hub does not validate the Origin header, and no secret is required. The page's script sends desktopCommand frames that first enumerate workspace state and MCP/provider configuration to confirm a usable target, then rewrites provider/model settings or directly issues a command-execution instruction. Because a provider/model is already configured (the normal operating state), Cline executes the attacker's instruction with the developer's local privileges — potentially exfiltrating source code and secrets, installing persistence, or pivoting to other systems reachable from the developer's machine — all without the developer noticing anything beyond having briefly visited a webpage.