low2.9
CVE-2026-38924
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0.
Impact
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
Affected products
| Product | Affected versions |
|---|---|
| Oraios AI Serena | before 1.0.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server
- https://github.com/oraios/serena/commit/a7af5c1f8a9ea27102eac9e72f64dd97dbfefff3
- https://github.com/oraios/serena/commit/b00ae292ac2d49947506886f44eb1cad7b7d7cd1
- https://github.com/oraios/serena/compare/v0.1.4...v1.0.0
- https://github.com/oraios/serena/security/advisories/GHSA-m922-r24v-6wff
- https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server