CVE-2026-38924 Details
Description
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
A vulnerability exists in the Oraios AI Serena application, specifically in versions prior to 1.0.0, where the default listen address for the MCP server in HTTP mode is set to 0.0.0.0. This configuration allows connections from any IP address, which can be a security risk. Although the documentation recommended using a sandboxed environment for running Serena, the default listen address could expose the server to untrusted networks.
Users can upgrade to Oraios AI Serena version 1.0.0 or later, where the default listen address has been changed to localhost. For versions prior to 1.0.0, it is recommended to manually set the listen address to 127.0.0.1 and to use a sandboxed environment, such as a Docker container, to run the application.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 14, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server | CISA-ADP | Technical Analysis |
| https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server | [email protected] | Technical Analysis |
| https://github.com/oraios/serena/commit/a7af5c1f8a9ea27102eac9e72f64dd97dbfefff3 | [email protected] | Source CodeVendor |
| https://github.com/oraios/serena/commit/b00ae292ac2d49947506886f44eb1cad7b7d7cd1 | [email protected] | Source CodeVendor |
| https://github.com/oraios/serena/compare/v0.1.4...v1.0.0 | [email protected] | Release NotesVendor |
| https://github.com/oraios/serena/security/advisories/GHSA-m922-r24v-6wff | [email protected] | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-669 | Incorrect Resource Transfer Between Spheres | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Oraios AI Serena | < 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 14, 2026 | New CVE Received | [email protected] |