2026-05-12 · 2026-Q2
Cline AI Agent Unauthenticated WebSocket RCE (CVE-2026-44211)
Which agent, run, or tenant is this?
- Fixable
- Vendor patch
- Vendor response
- Unknown
- In the wild
- No
- Actor
- Attacker
Target
Cline AI coding agent (the bundled Kanban npm server) on macOS, Linux, and Windows; no patched version at disclosure
Impact
A malicious webpage can reach Cline's background local WebSocket server on port 3484, leak filesystem paths, git branch details, task titles, and live agent chat messages, and execute arbitrary code on the developer's machine
Root cause
The local WebSocket server started with no authentication and no Origin-header validation, and browsers do not restrict cross-origin WebSocket connections to localhost. Documented by Oasis Security and researcher TheRealSpencer
CVE
Sources
Catalog
Cite this: AgentProv incident record: Cline AI Agent Unauthenticated WebSocket RCE (CVE-2026-44211) (2026-05-12). https://agentprov.com/incidents/2026-05-12-cline-ai-agent-unauthenticated-websocket-rce-cve-2026-44211
Related
- Also L6 · 2026-10-27MCP Server and LangGraph Advisory Batch: AWS API MCP Accepts Other Apps' Tokens, GitLab MCP Sends Credentials to a Repo-Chosen Registry, and Cross-Tenant Store Reads (CVE-2026-115413, CVE-2026-115883)L6Identity / Run
- Also L6 · 2026-10-23OpenAI Moves Frontier Training Offline After Red-Team Agents Escaped VMs and Signaled Through the CPU Cache; Their Brotli RCE Lands in CISA KEV (CVE-2026-111497)L6Identity / Run
- Also L6 · 2026-10-21Symantec: "Skynet Mode" Attack Agent Hijacks Exposed LLM Endpoints to Hack and Mine at the Model Owner's ExpenseL6Identity / Run