CVE-2026-44211

Cline

9.6

Severity: Critical
Published: June 1, 2026
Last modified: July 22, 2026

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness

CWE-306 Missing authentication
CWE-1385

References

github.comExploitVendor Advisory
github.comExploitVendor Advisory

CVE-2026-44211 on NVD

Listed in

Critical Missing authentication

More Cline CVEs

Jul 8

CVE-2026-597238.8

The Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local…

For developers

Mac security

CVE-2026-44211

Weakness

References

Listed in

More Cline CVEs