CVE-2026-38924: Oraios AI Serena Information Disclosure Flaw

CVE-2026-38924 Overview

CVE-2026-38924 affects Oraios AI Serena versions prior to 1.0.0. The Model Context Protocol (MCP) server, when run in HTTP mode, binds to 0.0.0.0 by default. This exposes the MCP interface on every network interface of the host rather than restricting it to loopback.

Serena's documentation at the time of the issue report recommended running Serena inside a sandboxed environment. The supplier acknowledged that binding to 0.0.0.0 was a potential security hazard. The issue is classified under [CWE-669] Incorrect Resource Transfer Between Spheres.

Critical Impact
An MCP server intended for local developer use becomes reachable from other hosts on the same network, expanding the attack surface of the workstation running Serena.

Affected Products

Oraios AI Serena versions before 1.0.0
Serena MCP server component when launched in HTTP transport mode
Deployments relying on the default --host value for the MCP server

Discovery Timeline

2026-09-14 - CVE CVE-2026-38924 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-38924

Vulnerability Analysis

Serena exposes an MCP server used by AI coding assistants to interact with local project files and tooling. When operators launch Serena with HTTP transport, the --host option defaults to 0.0.0.0, causing the server to listen on all interfaces.

Because the MCP server was designed for local, trust-based interaction with an AI client, it does not enforce authentication suitable for network exposure. Any host that can reach the listener port can send MCP requests. Public write-ups describe the resulting exposure as enabling unauthenticated remote interaction with the Serena MCP server. See the security research write-up for a detailed analysis.

Root Cause

The root cause is an insecure default configuration in the CLI and server bootstrap. Both src/serena/cli.py and src/serena/mcp.py set the listen address to 0.0.0.0. The value crosses a trust boundary by moving the server from the loopback sphere to the broader network sphere without adding compensating access controls.

Attack Vector

Exploitation requires network reachability to the port hosting the MCP server. An adjacent attacker on the same LAN, VPN segment, or shared Wi-Fi can connect to the exposed listener while a developer is running Serena in HTTP mode. Attack complexity is elevated because the attacker must be on-path to the affected host and Serena must be actively running.

python

# Patch: src/serena/cli.py - default listen address changed to loopback
@click.option(
    "--host",
    type=str,
-   default="0.0.0.0",
+   default="127.0.0.1",
    show_default=True,
    help="Listen address for the MCP server (when using corresponding transport).",
)

Source: oraios/serena commit b00ae29

python

# Patch: src/serena/mcp.py - server factory default changed to loopback
def create_mcp_server(
    self,
-   host: str = "0.0.0.0",
+   host: str = "127.0.0.1",
    port: int = 8000,
    modes: Sequence[str] = (),
    language_backend: LanguageBackend | None = None,
)

Source: oraios/serena commit b00ae29

Detection Methods for CVE-2026-38924

Indicators of Compromise

Serena MCP server process bound to 0.0.0.0 on TCP port 8000 or another operator-specified port
Inbound connections to the MCP port originating from non-loopback source addresses
MCP tool invocations in Serena logs that correlate with sessions not initiated by the local AI client

Detection Strategies

Enumerate listening sockets on developer workstations and flag Serena processes bound to non-loopback addresses using ss -tlnp or netstat -anb
Inspect Serena command-line arguments in process telemetry for the absence of --host 127.0.0.1 when HTTP transport is used
Review host firewall logs for connections to Serena's MCP port from remote sources

Monitoring Recommendations

Alert when new listeners appear on wildcard addresses on endpoints that historically only used loopback services
Track version strings of installed serena packages against the fixed 1.0.0 release
Correlate MCP session activity with the presence of an authenticated local AI client on the same host

How to Mitigate CVE-2026-38924

Immediate Actions Required

Upgrade Serena to version 1.0.0 or later, which sets the default listen address to 127.0.0.1
Explicitly pass --host 127.0.0.1 when starting Serena in HTTP mode until upgrades are complete
Restrict host firewall rules so that Serena's MCP port is reachable only from loopback

Patch Information

The fix is delivered in Oraios AI Serena 1.0.0. Review the GitHub security advisory GHSA-m922-r24v-6wff and the v0.1.4 to v1.0.0 comparison for the full change set. The listen-address correction is implemented in commits a7af5c1 and b00ae29.

Workarounds

Run Serena inside a sandboxed environment such as a container with no exposed ports, as recommended by the vendor documentation
Bind the MCP server to 127.0.0.1 explicitly through the --host flag or the create_mcp_server(host=...) parameter
Place a host-based firewall rule that drops inbound traffic to the MCP port from non-loopback interfaces

bash

# Launch Serena MCP server bound to loopback only
serena start-mcp-server --transport http --host 127.0.0.1 --port 8000

# Linux firewall example: block external access to the MCP port
sudo iptables -A INPUT -p tcp --dport 8000 ! -i lo -j DROP