CVE-2026-44211: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-06-01 · updated 2026-07-22
Weakness: CWE-306

Description

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Affected products

cline: through 2.13.0

References

https://github.com/cline/cline/security/advisories/GHSA-5c57-rqjx-35g2
https://github.com/cline/cline/security/advisories/GHSA-5c57-rqjx-35g2

Get alerted when CVE-2026-44211 or the next vulnerability affects your stack