CVE-2026-38924
Low
Description
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
SeverityLow
CVSS2.9
Exploit probability—
ProductSerena
PublishedSep 14, 2026
First seenSep 14, 2026
Weakness typeCWE-669CWE-669
How to fix
Update
- Oraios AI Serena1.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Oraios AI Serena | v < 1.0.0 | 1.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.