CVE-2026-49471: Serena MCP Toolkit RCE Vulnerability

CVE-2026-49471 Overview

CVE-2026-49471 affects Serena, a Model Context Protocol (MCP) toolkit that provides semantic code retrieval and editing capabilities. Versions prior to v1.5.2 expose an unauthenticated Flask API on a fixed, predictable port through the built-in web dashboard. The API lacks authentication, Cross-Site Request Forgery (CSRF) protection, and Host header validation. A DNS rebinding attack lets a malicious webpage reach this API from any browser and write arbitrary content to the agent's persistent memory store. Combined with execute_shell_command invoked with shell=True, this creates a remote code execution chain triggered when a victim visits an attacker-controlled page while Serena is running.

Critical Impact
Remote code execution on any host running vulnerable Serena versions, achieved solely by luring a user to visit a malicious webpage in a browser.

Affected Products

Serena MCP toolkit prior to v1.5.2
Built-in Flask web dashboard component (src/serena/dashboard.py)
Any deployment exposing the dashboard on its default local port

Discovery Timeline

2026-07-07 - CVE-2026-49471 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-49471

Vulnerability Analysis

The Serena dashboard runs a Flask HTTP server bound to a predictable local port. Requests are accepted without authentication tokens, session cookies, or origin verification. Because the server does not validate the Host header, a browser tricked into resolving an attacker-controlled domain to 127.0.0.1 (DNS rebinding) can issue same-origin requests to the API. The API exposes endpoints that write into the agent's persistent memory store. Serena reads that memory autonomously and acts on its contents.

The exploit chain terminates in execute_shell_command, which Serena invokes with shell=True. Attacker-controlled memory entries become shell commands executed under the user account running the agent. The root weakness maps to [CWE-306] Missing Authentication for Critical Function.

Root Cause

The dashboard was designed as a local-only debug interface but relied on network reachability alone as a trust boundary. It did not enforce authentication, CSRF tokens, or Host header allowlisting. Browsers respect DNS resolution rather than IP-level locality, so any page a user visits can rebind a hostname to 127.0.0.1 and drive the API from within a same-origin context.

Attack Vector

An attacker hosts a webpage that resolves a controlled domain with a short DNS Time-To-Live (TTL). After the initial load, DNS is rebound to 127.0.0.1 on Serena's fixed port. JavaScript on the page issues writes to the memory API, injecting instructions the agent will later execute through execute_shell_command.

python

 from typing import TYPE_CHECKING, Any, Optional, Self
 
 import psutil
-from flask import Flask, Response, redirect, request, send_from_directory
+from flask import Flask, Response, abort, redirect, request, send_from_directory
 from PIL import Image
 from pydantic import BaseModel
 from sensai.util import logging

Source: GitHub commit 016ccbe. The patch imports abort and adds per-request host and port validation so requests carrying an unexpected Host header are rejected before reaching sensitive handlers.

Detection Methods for CVE-2026-49471

Indicators of Compromise

Inbound HTTP requests to the Serena dashboard port carrying a Host header that is not localhost or 127.0.0.1.
Unexpected writes to the Serena agent memory store followed by shell process spawns from the agent's parent process.
Child processes of the Serena runtime executing shell commands not initiated by the local user, especially network utilities, package managers, or credential-access tools.

Detection Strategies

Monitor local HTTP traffic to the Serena dashboard port and alert on any request where the Host header does not match an allowlisted local value.
Baseline Serena process behavior and flag deviations such as new outbound network connections, file writes outside project directories, or spawning of /bin/sh, bash, cmd.exe, or powershell.exe.
Correlate browser process activity with Serena child process creation to identify DNS rebinding sequences.

Monitoring Recommendations

Enable process tree logging on developer workstations running MCP agents and forward events to a central Security Information and Event Management (SIEM) platform.
Log DNS query responses that resolve external domains to loopback addresses, a common DNS rebinding signature.
Track installed versions of Serena across endpoints and alert on any host still running a release earlier than v1.5.2.

How to Mitigate CVE-2026-49471

Immediate Actions Required

Upgrade Serena to v1.5.2 or later on every developer workstation and build agent where the toolkit is installed.
Stop any running Serena dashboard instances that cannot be immediately upgraded and restrict browser usage on those hosts until patching completes.
Audit the agent's persistent memory store for entries that appear to contain shell command payloads and purge them before restart.

Patch Information

The fix is delivered in Serena v1.5.2. Commit 016ccbe1c095a3eed7967737ac1d4df2754f5d96 adds per-request Host header and port validation in src/serena/dashboard.py, rejecting requests that do not target the expected local origin. Details are documented in the GitHub Security Advisory GHSA-37h2-6p4f-mp3q.

Workarounds

Bind the Serena dashboard to a non-routable interface behind a host firewall rule that denies all inbound HTTP unless upgrading is not immediately possible.
Configure the local DNS resolver or browser to block resolution of public domains to loopback addresses to disrupt DNS rebinding.
Terminate the Serena process when not actively in use to eliminate the exposure window.

bash

# Upgrade Serena to the patched release
pip install --upgrade 'serena>=1.5.2'

# Verify the installed version
python -c "import serena, sys; print(serena.__version__)"