CVE-2026-49471CWE-306CWE-352

Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE

High · published July 7, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00373 · 30.0th percentile
Weaknesses
CWE-306 · Missing Authentication for Critical Function; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-07-07T20:50Z
EPSS history
Timeline
  • 07 JUL 20:50Z
    Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
    cvelistv5