CVE-2026-59723: Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOMSECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cline Hub dashboard (/browser endpoint)to a version that resolves this vulnerability.Fixed in 3.0.30
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59723?
The severity of CVE-2026-59723 is rated high with a score of 8.8.
How do I fix CVE-2026-59723?
To fix CVE-2026-59723, upgrade to Cline version 3.0.30 or later.
What type of attack does CVE-2026-59723 enable?
CVE-2026-59723 enables Cross-Origin WebSocket Hijacking when the Origin header is not validated.
What products are affected by CVE-2026-59723?
CVE-2026-59723 affects the Cline Hub dashboard server prior to version 3.0.30.
Is the Cline Hub dashboard server safe to use without a patch for CVE-2026-59723?
No, using the Cline Hub dashboard server without a patch for CVE-2026-59723 poses security risks.