CVE-2026-49471: Serena AI Toolkit DNS Rebinding RCE—Patch to v1.5.2

Technical summary

CVE-2026-49471 exploits a combination of architectural weaknesses in Serena's Flask-based dashboard API. The API binds to a fixed, easily-discoverable port, lacks authentication and CSRF protection, and does not validate the Host header. An attacker performs DNS rebinding by controlling a domain that resolves first to their server (for initial JavaScript delivery) and then to 127.0.0.1 (to reach the victim's local API). The browser's same-origin policy is bypassed because the rebind causes the victim's browser to treat subsequent requests as same-origin. With HTTP requests sent to the unprotected API, the attacker writes arbitrary JSON or commands into Serena's memory store. When the Serena agent processes its persistent state, it interprets the injected content as legitimate instructions. If those instructions invoke execute_shell_command with shell=True, arbitrary shell code executes. The vulnerability chain requires user interaction (visiting a malicious link) and relies on Serena being active, making the attack vector Network/User-Required with High complexity (AC:H) but with Critical impact when successful.

Business impact

Organizations deploying Serena for AI-assisted development face remote code execution risk to development workstations and build environments. A compromised Serena instance can run shell commands, read/write files, and pivot to other systems on the network. This is particularly severe in development pipelines where Serena might have elevated privileges or integration with CI/CD systems, artifact repositories, or source control. The attack is silent and requires no sophisticated adversary infrastructure—a malicious ad, compromised forum post, or social engineering link suffices. Teams using Serena should assume that users may visit untrusted web content during their workday.

Affected systems

oraios-ai Serena versions prior to v1.5.2 are affected. The vulnerability is present in all deployments where the dashboard is enabled and accessible to a browser on the same machine or local network. Organizations running Serena in isolated environments (e.g., air-gapped networks) or with network segmentation isolating development workstations are at reduced risk, but standard office networks offer no protection.

Exploitability

Exploitability is moderate in practice but high in impact. The attack requires the victim to visit an attacker-controlled or compromised webpage while Serena is running—a realistic scenario for development teams that browse the internet during work. No special privileges, credentials, or pre-existing access are needed. The DNS rebinding technique is well-understood and commonly used to probe local services. However, successful exploitation depends on the target running Serena actively and the attacker correctly guessing or discovering the port. The CVSS score of 8.3 (HIGH) reflects the combination of network attack vector, user interaction requirement, and high impact (confidentiality, integrity, and availability all compromised). This is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, but the simplicity of exploitation makes it likely to be weaponized once public disclosure is widespread.

Remediation

Upgrade Serena to version 1.5.2 or later immediately. The patch addresses all three root causes: it enforces authentication on the API, implements CSRF protection with token validation, and adds Host header validation to prevent DNS rebinding attacks. There is no workaround for unpatched versions other than disabling the dashboard entirely, which removes Serena's web interface functionality. Teams unable to patch immediately should isolate Serena instances from untrusted networks and restrict user browsing on machines running Serena.

Patch guidance

Verify your installed Serena version by checking the version output in your installation or the application's about/settings page. If you are on any version prior to v1.5.2, download and apply the update from the official oraios-ai repository. Test the patch in a non-production environment first to ensure compatibility with your existing Serena workflows and any integrations. After patching, restart the Serena service to ensure the new authentication and validation code is in effect. If you are already on v1.5.2 or later, no action is required for this specific vulnerability.

Detection guidance

Monitor for suspicious HTTP requests to the Serena API port (verify the default port from your deployment documentation). Look for POST requests to API endpoints with unusual JSON payloads, particularly those containing shell commands or executable code. Examine Serena's persistent memory or configuration files for injected content that you did not explicitly add. Check browser history and DNS logs on development workstations for evidence of DNS rebinding attacks (multiple A records returned for the same domain, or rapid resolution changes). If you suspect an attack, inspect Serena's execution logs for unexpected shell commands and audit the system for signs of lateral movement or data exfiltration. Implement network-level monitoring to alert on requests to localhost services from external origins.

Why prioritize this

This vulnerability should be patched within 72 hours of inventory. The combination of easy exploitation (only requires a malicious link), high impact (remote code execution with user privileges), and broad applicability to development environments makes it a tier-1 priority. Development teams are frequent targets for supply-chain attacks, and Serena's role in the build and coding pipeline means compromise can affect code quality, security, and release integrity. While KEV status is not yet active, the technical simplicity ensures this will be exploited in the wild once the patch is publicly available. Early patching denies attackers an easy entry point and reduces the window of exposure.

Risk score, explained

CVSS 8.3 is justified by the following factors: AV:N indicates network-accessible attack surface with no special position required; AC:H reflects that DNS rebinding setup and user interaction are needed but both are practical; PR:N means no authentication is required; UI:R correctly captures that the victim must visit a malicious page; S:C accounts for scope change because the compromised Serena process can affect other services on the system; and C:H, I:H, A:H reflect that the attacker gains full code execution and can read, modify, and delete data. The HIGH severity is warranted for development and research environments where RCE is catastrophic.

Frequently asked questions