Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-59723

CVE-2026-59723HIGH

Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   A   L   N   R  C  H  H  H    8.8   .0025   14.7     —

AFFECTED
  Product  Versions    Fixed
  cline    < 3.0.30 –  —

TIMELINE
  Jul 6   Reserved by GitHub_M
  Jul 8   Published (CNA: GitHub_M)
  Aug 26  EXPLOIT PUBLISHED — CVE-2026-59723 (cline). Public exploit reference added.

CWE-346 · CNA: GitHub_M · CVSS v3.1 · 4 references · NVD status: Analyzed

Description

Cline is an autonomous coding agent as an SDK, IDE extension, or CLI assistant. Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin header, and when ROOM_SECRET is unset for local 127.0.0.1 binds, isAuthorizedBrowserRequest() allows attacker-controlled websites to send desktopCommand frames that read workspace state, mutate MCP and provider settings, and trigger command execution when a provider or model is configured. This issue is fixed in version 3.0.30.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 6, 2026	Reserved	Reserved by GitHub_M
July 8, 2026	Published	Published (CNA: GitHub_M)
August 26, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-59723 (cline). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
cline	cline	—	< 3.0.30	—

Weaknesses

CWE-346

References (4)

https://github.com/cline/cline/commit/d09270940f5746f288cfc4a5039b46a2f4d5d01e [Patch]
https://github.com/cline/cline/pull/11724 [Issue Tracking, Patch]
https://github.com/cline/cline/releases/tag/cli-v3.0.30 [Release Notes]
https://github.com/cline/cline/security/advisories/GHSA-3cj3-hqcr-g934 [Exploit, Vendor Advisory]

Authoritative record: CVE-2026-59723 at cve.org

Vendors: cline

Weaknesses: CWE-346

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-59723 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.