What is the CVSS score of CVE-2026-49471?

CVE-2026-49471 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Python are affected by CVE-2026-49471?

Oraios Serena MCP coding toolkit versions prior to v1.5.2 contain a remote code execution vulnerability triggered when developers visit any website while using the tool, placing development teams at…. A patch is available.

Is there a public PoC exploit available for CVE-2026-49471?

Yes, a public proof-of-concept exploit is available for CVE-2026-49471. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-49471?

Within 24 hours: Disable Oraios Serena's web dashboard or isolate affected development machines from untrusted networks; contact Oraios for patch availability and timeline. Within 7 days: Audit systems running vulnerable Serena versions for unauthorized access or credential compromise; implement DNS rebinding defenses and Host-header validation at network perimeter. Within 30 days: Deploy v1.5.2 immediately upon vendor release; if unavailable after 30 days, transition development teams to alternative tools or implement permanent network isolation for Serena systems.

Python CVE-2026-49471

EUVD-2026-42077 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-07 GitHub_M

GHSA-37h2-6p4f-mp3q

Authentication Bypass RCE Python CSRF Serena

8.3

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:36 vuln.today

CVE Published

Jul 07, 2026 - 20:50 cve.org

HIGH 8.3

DescriptionCVE.org

Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protection, and no Host header validation. A DNS rebinding attack allows a malicious webpage to reach this API from any browser and write arbitrary content to the agent's persistent memory store, which the agent reads and acts on autonomously. Combined with execute_shell_command using shell=True, this creates a remote code execution chain requiring only that the victim visit a malicious webpage while Serena is running. This issue is fixed in version v1.5.2.

Articles & Coverage 1

News 3 New Python Vulnerabilities - 3 High Severity, No Public Exploits Jul 08, 2026

AnalysisAI

Remote code execution in the Oraios Serena MCP coding toolkit (prior to v1.5.2) lets a malicious webpage hijack a developer's local coding agent via DNS rebinding. Serena's built-in web dashboard runs an unauthenticated Flask API on a fixed, predictable port with no auth, no CSRF protection, and no Host-header validation, so any site the victim visits while Serena is running can write attacker-controlled content into the agent's persistent memory store; because the agent autonomously reads that memory and can invoke execute_shell_command with shell=True, this chains to code execution on the developer's machine. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.