Is CVE-2026-38924 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-38924?

CVE-2026-38924 has a CVSS v3 severity of LOW (2.9).

Back

CVE-2026-38924

Description

In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."