Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-09-24

HighPrimary

Cline Hub Cross-Origin WebSocket Flaw Let Malicious Websites Inject MCP Commands and Control Auto-Approved Agent Sessions

CVE-2026-59723 let a malicious website connect to the local Cline Hub dashboard, alter MCP settings, and steer auto-approved agent sessions.

Cline HubTool execution / MCPCross-origin WebSocket hijacking and unauthorized agent-tool configurationDeveloper workstations running the Cline Hub dashboard with its default local configuration

What happened

In controlled testing, a cross-origin WebSocket client sent a desktopCommand frame that added an attacker-chosen stdio MCP server entry to the victim's Cline settings and received an ok response.

Why it matters

The demonstrated impact was persistent unauthorized MCP configuration modification. The advisory documents potential local file, command, network, and credential access when the injected server is activated or a configured model drives an auto-approved session.

Missing authorization check

Independent authorization for MCP server changes and consequential tool execution, bound to the caller, command, target, and session.

Would PP block it?

Protected merge, deployment, publication, credential use, and infrastructure operations could require a receipt scoped to the exact action and target. A hijacked Cline session or injected MCP process would not possess that independent authority.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-09-24

    GitHub publishes GHSA-3cj3-hqcr-g934 and CVE-2026-59723 with dynamic reproduction details.

  2. 2026-09-24

    Cline 3.0.30 is identified as the first patched release.

Technical breakdown

  • The local /browser WebSocket endpoint did not validate the HTTP Origin header.
  • With ROOM_SECRET unset in the default local bind, browser requests were authorized without a secret.
  • The reproduced desktopCommand call wrote an attacker-controlled stdio MCP server entry into Cline settings.
  • Dashboard-created sessions defaulted to auto-approving tools, increasing the consequence of session control.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Tool-Call Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Consequential tool and credential boundaries outside the Cline Hub process
Still needs
The dashboard vulnerability, local WebSocket access, settings-file mutation, command execution inside an ungoverned workstation, and data reachable without an integrated gate remain outside coverage.
Receipt required for
Adding or activating an MCP server and using protected credentials or tools to merge, deploy, publish, export data, or mutate infrastructure

Permission Protocol cannot repair Cline's missing Origin validation or prevent local settings writes, but an external Tool-Call Gate can deny consequential downstream actions that lack a separately authenticated receipt.

Start small

Put the relevant gate at this action boundary.

This incident maps to Tool-Call Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop