Description
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Oraios AI Serena
Default version status: unaffected
0 to < 1.0.0affected
References
- https://github.com/oraios/serena/commit/b00ae292ac2d49947506886f44eb1cad7b7d7cd1 ↗
- https://github.com/oraios/serena/security/advisories/GHSA-m922-r24v-6wff ↗
- https://dash.security/blog/cve-2026-38924-unauthenticated-rce-in-the-serena-mcp-server ↗
- https://github.com/oraios/serena/compare/v0.1.4...v1.0.0 ↗
- https://github.com/oraios/serena/commit/a7af5c1f8a9ea27102eac9e72f64dd97dbfefff3 ↗