CVE-2026-42283: DevSpace UI Server WebSocket CheckOrigin does not validate source

(updated )

DevSpace’s UI server WebSocket accepts connections from all origins by default, and therefore several endpoints are exposed via this WebSocket. When a developer runs the DevSpace UI and at the same time uses a browser to access the internet, a malicious website they visit can use their browser to establish a cross-origin WebSocket connection to ws://127.0.0.1:8090. This allows an attacker to access:

  • /api/logs to stream real-time pod logs
  • /api/enter to open an interactive shell inside the running pod
  • /api/command to execute pre-defined pipeline commands

References

Code Behaviors & Features

Detect and mitigate CVE-2026-42283 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →