Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability

Description

The kanban npm package (used by the cline CLI) starts a WebSocket server on 127.0.0.1:3484 with no Origin header validation. Any website a developer visits can silently connect to the kanban server via WebSocket and:

Recommendation

No fix is available yet. Followings are affected versions:

<= 2.13.0

References

GHSA-5c57-rqjx-35g2
CVE-2026-44211
CWE-1385
CWE-306
CAPEC-310
OWASP 2021-A6
OWASP 2021-A7

Could your website be exposed too?

SmartScanner can check your website for Cline Kanban Server has a Cross-Origin WebSocket Hijacking Vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

NotChatbot WebChat has a stored cross-site scripting (XSS) vulnerability - CVE-2026-30048
Storybook Dev Server is Vulnerable to WebSocket Hijacking - CVE-2026-27148
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests - CVE-2026-39371
Waku: Cross-Origin CSRF on RSC Server Action Dispatch - CVE-2026-49455

Exploiting Server Version Disclosure

CSRF, XXE, and 12 Other Security Acronyms Explained

How do hackers hack websites?

See something that needs correcting? Let us knowUpdated June 09, 2026