Cline Hub Dashboard CSWSH Leading to MCP Settings Hijack and Command Execution
First seen Jul 9, 2026 · Updated Jul 9, 2026 · CVSS 8.8
Cline's local Hub dashboard server fails to validate the Origin header on its WebSocket /browser endpoint, allowing any malicious website visited by a user to connect and issue commands. When ROOM_SECRET is unset (the default for local binds), attackers can read workspace state, tamper with MCP and provider settings, and trigger arbitrary command execution if a model provider is configured. This is a critical, fully remotely exploitable vulnerability via drive-by browser interaction with no user awareness required.
Technical Analysis
The Cline Hub dashboard binds a WebSocket listener on 127.0.0.1 intended for local browser-based UI control, but isAuthorizedBrowserRequest() does not enforce Origin header checks and permits unauthenticated connections when ROOM_SECRET is unset. This enables a classic cross-site WebSocket hijacking (CSWSH) attack: a malicious web page opened in the victim's browser can establish a WebSocket connection to localhost and send desktopCommand frames as if it were the legitimate dashboard client. Because the Hub bridges browser-originated commands into the Cline agent's internal control plane, the attacker gains the ability to read workspace/project state, modify MCP server configurations and provider/model settings, and ultimately achieve command execution once a provider is configured — effectively crossing the trust boundary between an untrusted web origin and a privileged local agent process with filesystem/tool access.
Affected Systems
Cline; protocols: MCP
Detection Signatures
- WebSocket connections to /browser endpoint on Cline Hub port from non-localhost or unexpected Origin headers
- Absence or empty value of ROOM_SECRET environment variable in Cline Hub deployments
- desktopCommand frames received without prior authenticated handshake
- Unexpected mutation of MCP server configuration files without corresponding user-initiated dashboard action
- Cline Hub process logs showing WebSocket upgrade requests lacking Origin validation rejects
Remediation Steps
- 1
Upgrade Cline
Update to Cline 3.0.30 or later, which fixes the Origin validation and authorization logic in isAuthorizedBrowserRequest().
- 2
Set ROOM_SECRET
Always configure a strong ROOM_SECRET even for local 127.0.0.1-bound Hub instances to enforce authenticated WebSocket connections.
- 3
Enforce Origin validation
Ensure the Hub server explicitly validates the Origin header on all WebSocket upgrade requests and rejects connections from browser-originated third-party pages.
- 4
Network isolation
Restrict Hub dashboard listener to loopback only and avoid exposing the port via port-forwarding, VPN, or container network bridges accessible to untrusted hosts.
- 5
Audit MCP settings changes
Monitor and log all changes to MCP server and provider configuration files to detect unauthorized modifications.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.