Why it matters
Serena is an MCP server used with AI coding agents; even at the disputed low CVSS score, a default-0.0.0.0 MCP listener is a recurring root cause across this digest's agentic-tool findings (Bifrost, PraisonAI, LangBot) — network-exposed-by-default agent tool servers are a systemic pattern worth flagging even where the CNA and a third-party researcher disagree on exploit impact.
Attack vector
Serena's MCP server binds its HTTP-mode listener to 0.0.0.0 rather than 127.0.0.1 by default, exposing the coding-agent MCP server to the network if not otherwise firewalled. NVD/MITRE scored this LOW (3.1: AV:L/AC:H, base 2.9) and marked the CVE status Disputed; a third-party post (dash.security) characterizes the same issue as unauthenticated RCE via the exposed MCP tool surface, a materially higher severity claim than the CNA's own scoring.
Affected systems
Oraios AI Serena before 1.0.0
Mitigation
Upgrade to Serena 1.0.0 or bind the server to 127.0.0.1 / run in a sandboxed environment as the project's own documentation recommends; verify network exposure regardless of which severity assessment you credit.