What is the CVSS score of CVE-2026-59723?

CVE-2026-59723 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Cline are affected by CVE-2026-59723?

Cline Hub dashboard versions before 3.0.30 contain a cross-origin WebSocket vulnerability allowing local network attackers to hijack developer sessions without authentication and execute commands on…

How to fix or mitigate CVE-2026-59723?

Within 24 hours: Audit all Cline Hub deployments for affected versions; isolate dashboard processes from untrusted networks; verify ROOM_SECRET environment variable is configured. Within 7 days: Upgrade all Cline Hub instances to version 3.0.30 or later. Within 30 days: Confirm complete patch deployment across all systems and review security logs for unauthorized access attempts.

Cline CVE-2026-59723

HIGH

Origin Validation Error (CWE-346)

2026-07-08 security-advisories@github.com

Information Disclosure Cline

8.8

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

8.3 HIGH

Any internet site reaching loopback justifies AV:N over NVD's AV:A; AC:H reflects the required non-default state (ROOM_SECRET unset plus configured provider); UI:R as the victim must visit the page; S:C as browser origin control crosses into host actions.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 23:32 vuln.today

DescriptionCVE.org

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

AnalysisAI

Cross-origin WebSocket hijacking in the Cline Hub dashboard server (the process started by cline dashboard) before version 3.0.30 lets a malicious website drive an active local Cline session. Because the /browser WebSocket endpoint does not validate the Origin header and isAuthorizedBrowserRequest() trusts any request when ROOM_SECRET is unset on a 127.0.0.1 bind, any site a victim visits can send desktopCommand frames to read workspace state, alter MCP and provider/model settings, and-when a provider or model is configured-invoke command execution on the developer's machine. There is no public exploit identified at time of analysis and it is not in CISA KEV; the flaw is a classic origin-validation gap (CWE-346) fixed in 3.0.30.

Technical ContextAI

Cline is an autonomous coding agent delivered as an SDK, IDE extension, and CLI. The affected component is the local Hub dashboard server it launches, which exposes a WebSocket control channel at /browser intended for the local desktop/IDE frontend to issue privileged desktopCommand frames. The root cause is CWE-346 (Origin Validation Error): browsers freely allow cross-origin WebSocket connections and do not enforce same-origin policy on the WebSocket handshake, so a server MUST verify the Origin header (or a shared secret) itself. Here, when the server binds to 127.0.0.1 and ROOM_SECRET is not set, the authorization gate isAuthorizedBrowserRequest() returns true regardless of Origin, so JavaScript running on any external website loaded in the victim's browser can open a socket to the loopback port and speak the privileged control protocol. Because those frames map to real desktop actions-reading workspace files/state, mutating MCP server and AI provider configuration, and triggering command execution-the browser origin boundary is effectively crossed into local host control, matching the CVSS scope-change (S:C) assignment.

RemediationAI

Vendor-released patch: upgrade Cline to 3.0.30 or later (release cli-v3.0.30), which adds Origin validation for the /browser WebSocket endpoint per the GitHub Security Advisory GHSA-3cj3-hqcr-g934 (https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934) and pull request https://github.com/cline/cline/pull/11724 (commit d09270940f5746f288cfc4a5039b46a2f4d5d01e). If you cannot upgrade immediately, set a non-empty ROOM_SECRET so isAuthorizedBrowserRequest() no longer auto-authorizes local connections (trade-off: the dashboard frontend must be configured with the same secret to keep working), and avoid running cline dashboard while browsing untrusted sites-stop the dashboard server when not actively in use. As an additional compensating control, remove or defer configuring an AI provider/model until after upgrading, since command execution via the malicious frames is only reachable when a provider or model is configured (trade-off: this disables Cline's core agent functionality). Restricting the machine's browser from loading untrusted content or isolating development in a separate browser profile further reduces the drive-by surface.