CVE-2026-44211 Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Attackers can hijack cross-origin WebSocket connections in Cline Kanban servers, potentially leading to unauthorized actions or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-44211?
CVE-2026-44211 is a critical vulnerability in cline, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.
Which versions are affected by CVE-2026-44211?
2 open source packages ship an affected version, including cline. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cline npm | All versions to 2.13.0 | None |
cline npm | All versions to 2.13.0 | None |
Products include Cline Cline.
How do I fix CVE-2026-44211?
No fix has been published for CVE-2026-44211 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-44211 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44211 exists.
Other vulnerabilities in cline
Sources
Also known as GHSA-5c57-rqjx-35g2.