CVE-2026-59723: Cline Hub Dashboard Cross-Origin WebSocket Hijacking Vulnerability
Summary
CVE-2026-59723: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (/browser endpoint). Affects cline versions < 3.0.30. Fixed in 3.0.30. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cline is an open-source tool that provides a dashboard for managing AI models and sessions. It allows developers to interact with various tools and services through a user-friendly interface. The Cline Hub dashboard, launched via the 'cline dashboard' command, facilitates real-time collaboration and management of AI workflows. However, it has a critical vulnerability that exposes it to cross-origin WebSocket hijacking, allowing unauthorized access to sensitive session data.
Vulnerability Detail
The vulnerability arises from the Cline Hub dashboard server's failure to validate the HTTP 'Origin' header when accepting WebSocket connections on the '/browser' endpoint. When the 'ROOM_SECRET' environment variable is not set, the server allows any website to establish a WebSocket connection to 'ws://127.0.0.1:8787/browser'. This enables an attacker-controlled page to send commands that can read and manipulate workspace state, execute arbitrary commands, and potentially exfiltrate sensitive information. The lack of origin validation and the default auto-approval of tools for dashboard sessions significantly increase the risk of exploitation.
How To Fix
Minimum fixed version
3.0.30
This is the first release that contains the fix.
npm install cline@3.0.30Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, set the 'ROOM_SECRET' environment variable to a strong, unique value before starting the Cline dashboard. This will enforce authorization checks and prevent unauthorized access. You can set it in your terminal as follows: 'export ROOM_SECRET=your_secure_secret'.
Conclusion
The Cline Hub dashboard vulnerability (CVE-2026-59723) poses a significant risk due to its potential for cross-origin WebSocket hijacking. It is crucial for developers using this tool to update to the patched version or implement workarounds to secure their applications against unauthorized access.
See every vulnerability recorded for cline →
FAQ
CVE-2026-59723 is a vulnerability in the Cline Hub dashboard that allows cross-origin WebSocket hijacking due to improper validation of the 'Origin' header.
An attacker can exploit this vulnerability to gain unauthorized access to sensitive session data, execute arbitrary commands, and manipulate workspace settings.
The CVSS score for this vulnerability is 8.8, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, ensure to set a strong 'ROOM_SECRET' environment variable to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for cline.
