CVE-2026-44211 CRITICAL

CVE-2026-44211: Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Vendor Cline

Product cline

Weakness CWE-306 · Missing auth

Published June 1, 2026

Last update June 4, 2026

View on NVD All CVEs

CVSS base score

9.6/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches.

Key dates

02Disclosure timeline

June 1, 2026 CVE published

June 4, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-44211 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2025-46275 Planet Technology Network Products Missing Authentication for Critical Function CVE-2026-27843 SenseLive X3050 Missing authentication for critical function CVE-2023-51571 Voltronic Power ViewPower Pro SocketService Missing Authentication Denial-of-Service Vulnerability CVE-2023-38123 Inductive Automation Ignition OPC UA Quick Client Missing Authentication for Critical Function Authentication Bypass Vulnerability CVE-2023-5716 ASUS Armoury Crate - Arbitrary File Write