Executive brief
DevSpace is a developer tool used to build and deploy cloud-native applications on Kubernetes. A security flaw in its local user interface allows malicious websites to hijack the tool's connection if a developer visits them while the tool is running. This could allow an attacker to view private application logs, execute commands, or gain shell access to the developer's cloud environment.
Technical details
The DevSpace UI server WebSocket (defaulting to port 8090) accepts connections from any origin due to a lack of validation in the WebSocket handshake. If a developer visits a malicious website while DevSpace is running locally, the site can initiate a cross-origin WebSocket connection to 127.0.0.1. This grants the attacker access to sensitive endpoints including /api/logs for real-time pod logs, /api/enter for interactive shell access, and /api/command for pipeline execution. The vulnerability is a Cross-Site WebSocket Hijacking (CSWSH) issue resulting from missing authentication and origin checks. It is fixed in version 6.3.21.
Affected products
- DevSpace DevSpace < 6.3.21
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-14: disclosed: CVE published to NVD