CVE-2026-42283 DevSpace UI Server WebSocket CheckOrigin does not validate source
A malicious website can access DevSpace UI server endpoints via cross-origin WebSocket connections, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42283?
CVE-2026-42283 is a high-severity missing authorization vulnerability in devspace-sh devspace, published on 14 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This vulnerability is fixed in 6.3.21.
Which versions are affected by CVE-2026-42283?
3 open source packages ship an affected version, including github.com/loft-sh/devspace. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/loft-sh/devspace Go | All versions | None |
github.com/loft-sh/devspace Go | From 6.3.20 | 6.3.21 |
github.com/loft-sh/devspace Go | From 6.3.20 | 6.3.21 |
Products include Devspace Devspace.
How do I fix CVE-2026-42283?
Upgrade github.com/loft-sh/devspace to 6.3.21 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-42283 being exploited?
There is no known exploitation of CVE-2026-42283 in the wild and no public exploit code.
Other vulnerabilities in devspace-sh devspace
Sources
Also known as GHSA-hqwm-7x7x-8379, GO-2026-5433.