Executive brief
Oraios AI Serena is a development tool that runs an MCP (Model Context Protocol) server for AI integration. In versions before 1.0.0, the server listens on all network interfaces (0.0.0.0) by default in HTTP mode, which exposes it to unauthenticated remote code execution attacks from any network that can reach the server, rather than being restricted to localhost only.
Technical details
The vulnerability is an insecure default configuration in the MCP server component. The HTTP-mode listener defaults to binding on 0.0.0.0 (all interfaces) instead of 127.0.0.1 (localhost only), allowing unauthenticated remote code execution if the server is accessible over a network. No authentication is required to exploit this. The root cause is the overly permissive default binding address. The fix involves changing the default listen address to 127.0.0.1 and updating documentation to avoid reliance on environmental sandboxing as a security control, which was addressed in version 1.0.0 and later.
Affected products
- Oraios AI Serena before 1.0.0
Timeline
- 2026-09-14: disclosed: CVE-2026-38924 published in NVD
- 2026-07-13: patched: Fix described in security research, version 1.0.0 available