What is the CVSS score of CVE-2026-42283?

CVE-2026-42283 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of DevSpace are affected by CVE-2026-42283?

DevSpace UI Server (versions 6.3.20 and earlier) contains a Cross-Site WebSocket Hijacking vulnerability that allows remote attackers to execute arbitrary commands within Kubernetes pods by tricking…. A patch is available.

How to fix or mitigate CVE-2026-42283?

Within 24 hours: Identify all DevSpace installations running versions 6.3.20 or earlier using inventory/deployment management tools and document affected systems. Within 7 days: Upgrade all instances to DevSpace 6.3.21 or later. As interim mitigation, restrict network access to localhost:8090 to trusted networks only and disable the DevSpace UI server if not actively in use. Within 30 days: Audit WebSocket endpoint logs for suspicious cross-origin connection attempts and review pod access logs for unauthorized command execution during the vulnerable period.

DevSpace CVE-2026-42283

EUVD-2026-30319 HIGH

Information Exposure (CWE-200)

2026-05-06 https://github.com/devspace-sh/devspace

GHSA-hqwm-7x7x-8379

Information Disclosure Node.js

7.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.7 HIGH

AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 06, 2026 - 17:45 vuln.today

Analysis Generated

May 06, 2026 - 17:45 vuln.today

DescriptionGitHub Advisory

Description

DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This allows an attacker to access:

/api/logs to stream real-time pod logs
/api/enter to open an interactive shell inside the running pod
/api/command to execute pre-defined pipeline commands

Patches

Versions 6.3.21 and above are patched.

Resources

gorilla/websocket CheckOrigin documentation

Installation Options

Devspace is no longer publishing to NPM or Yarn, please continue to use our other installation methods to get updates in the future, including this patch.

Credit

DevSpace thanks @b0b0haha for finding and reporting this vulnerability.

AnalysisAI

Cross-Site WebSocket Hijacking in DevSpace UI Server allows remote attackers to execute commands inside Kubernetes pods when developers visit malicious websites while DevSpace UI is running. The UI server's WebSocket endpoint at localhost:8090 accepts connections from any origin, enabling browser-based exploitation without authentication. DevSpace 6.3.20 and earlier are affected; version 6.3.21 contains the fix. No public exploit code identified at time of analysis, but exploitation technique is well-documented in WebSocket security research. The vulnerability enables attackers to stream pod logs, open interactive shells, and execute pipeline commands through the victim's active DevSpace session.

Technical ContextAI

DevSpace is a Kubernetes development tool written in Go that provides a local UI server for managing development environments. The vulnerability stems from improper implementation of the gorilla/websocket library's CheckOrigin function, which by default returns true for all origins. The WebSocket server listens on localhost:8090 and exposes three critical API endpoints (/api/logs, /api/enter, /api/command) without origin validation. This is a Cross-Site WebSocket Hijacking (CSWSH) attack vector, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). Modern browsers allow JavaScript on any webpage to initiate WebSocket connections to localhost, and without CheckOrigin validation, the server cannot distinguish legitimate UI connections from attacker-controlled cross-origin requests. The affected package is pkg:go/github.com/loft-sh/devspace, and the fix in version 6.3.21 implements proper origin checking per gorilla/websocket security guidelines.

RemediationAI

Upgrade to DevSpace 6.3.21 or later, which implements proper WebSocket origin validation per the gorilla/websocket CheckOrigin security model. The patch is available through standard DevSpace installation methods documented at https://www.devspace.sh/docs/getting-started/installation - do NOT use deprecated NPM/Yarn packages. If immediate upgrade is not feasible, implement the following compensating controls: (1) Only run DevSpace UI when actively needed, then terminate the process - this minimizes the attack window to seconds rather than hours. (2) Use browser profiles or separate browsers for development work versus general web browsing, ensuring the browser running DevSpace UI never navigates to untrusted sites. (3) Deploy network-level controls to block outbound WebSocket connections from web browsers to localhost:8090, though this may interfere with legitimate UI functionality. (4) Consider firewall rules restricting which processes can bind to port 8090, though this is complex to implement correctly. Note that disabling the UI server entirely eliminates the attack surface but removes DevSpace's visual management capabilities. The primary fix (upgrade to 6.3.21) has no known side effects and is the recommended remediation.