Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability
Date: 2026-05
Affected: npm/cline
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-44211
CWE: CWE-1385
CWE-306
CVSS: 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H)

## Summary The `kanban` npm package (used by the `cline` CLI) starts a WebSocket server on `127.0.0.1:3484` with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and: 1. Leak sensitive data in real-time: workspace filesystem paths, task titles/descriptions, git branch info, AI agent chat messages 2. Hijack running AI agent terminals by injecting arbitrary prompts into the agent's input, leading to remote code execution 3. Kill running agent tasks by terminating active sessions via the control WebSocket WebSocket connections are not subject to CORS restrictions. The browser sends them freely to localhost regardless of the page's origin. The kanban server accepts all connections without checking the Origin header. ## Affected Component - Package: `kanban` on npm (https://www.npmjs.com/package/kanban) - Repository: https://github.com/cline/kanban - Tested version: 0.1.59 - Installed via: `cline` CLI (`cline --kanban` or default `cline` command) - Endpoints: `ws://127.0.0.1:3484/api/runtime/ws`, `ws://127.0.0.1:3484/api/terminal/io`, `ws://127.0.0.1:3484/api/terminal/control` ## Root Cause Three WebSocket endpoints are exposed without authentication or Origin validation. ### 1. Runtime state stream (no Origin check on upgrade) ```javascript server.on("upgrade", (request, socket, head) => { if (normalizeRequestPath(requestUrl.pathname) !== "/api/runtime/ws") { return; } // No Origin hea


Mitigations:

Architectural layers (MAESTRO):