p PatchFirst

CVE-2026-44211

CVE-2026-44211 · Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

CVSS 9.6 · Critical · EPSS 0.2%

Published
Updated

Stack: node

Affected products and versions

  • cline

    Versions
    • <= 2.13.0: Affected

    No fix published

  • cline npm

    Affected ranges
    • SEMVER: ≤ 2.13.0

    No fix published

Original sources

Check your server →