CVE-2026-49471 Serena: Unauthenticated Flask dashboard on fixed port enables DNS rebinding → memory poisoning → RCE
An attacker can achieve remote code execution by using DNS rebinding to exploit an unauthenticated Flask dashboard and poison agent memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-49471?
CVE-2026-49471 is a high-severity vulnerability in oraios serena, published on 7 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.
Which versions are affected by CVE-2026-49471?
3 open source packages ship an affected version, including serena-agent. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
serena-agent PyPI | All versions | 1.5.2 |
serena-agent PyPI | All versions | 1.5.2 |
serena-agent PyPI | All versions | 1.5.2 |
Products include Oraios-Ai Serena.
How do I fix CVE-2026-49471?
Upgrade serena-agent to 1.5.2 or later.
Is CVE-2026-49471 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-49471 exists.
Sources
Also known as GHSA-37h2-6p4f-mp3q, PYSEC-2026-3061.