Hub/AI Security/Cline
Cline
Cline · Official site
3 Yes1 Partial0 No6 Unknown
| Feature | Status | Notes | Source | Checked |
|---|---|---|---|---|
| Tool-call approval prompts | Yes | Asks before actions unless Auto-approve / YOLO is enabled | Source | 2026-11-04 |
| Per-tool allow / deny | Partial | Auto-approve per action category, incl. MCP | Source | 2026-11-04 |
| Sandboxing | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| OAuth for remote MCP | Yes | Browser authorization for remote servers | Source | 2026-11-04 |
| Verified marketplace listings | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| Auto-install / auto-update control | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| Admin allowlists | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| Audit logs | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| Data retention / training opt-out | Unknown | Not found in official docs checked 2026-11-04 | — | 2026-11-04 |
| Security disclosure page | Yes | Advisories published on cline/cline | Source | 2026-11-04 |
Advisories (3)
Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
Cline · CVE-2026-59723 · GHSA-3cj3-hqcr-g934
Cross-Origin WebSocket Hijack in Cline Kanban Server
Cline · CVE-2026-44211 · GHSA-5c57-rqjx-35g2
Unauthorized npm publish of Cline CLI cline@2.3.0 with modified postinstall script to install openclaw
Cline · GHSA-9ppg-jx86-fqw7
Across the hub
Weekly, free
What changed in AI integrations
One short email when MCP clients, plugin ecosystems, IDE integrations, AI plan prices or security advisories change. Every item is sourced.