Loading story…
A high-severity vulnerability tracked as CVE-2026-49471 allows unauthenticated remote code execution in the Serena Model Context Protocol toolkit before version 1.5.2. Serena exposed a local Flask dashboard API on predictable port 24282 without authentication, CSRF protections, or Host header validation, letting an attacker use DNS rebinding from a malicious website to reach the victim’s local service through the browser. The attacker could then poison Serena’s persistent memory store with arbitrary content that the autonomous agent later reads and acts on.
The attack chain can lead to shell command execution on a developer workstation because Serena used execute_shell_command with shell=True, turning memory poisoning into code execution. Public reporting said a proof of concept is available and assigned the flaw a CVSS 8.3 severity rating. The issue is fixed in Serena 1.5.2, which adds Flask before_request Host header validation to restrict requests to localhost addresses, although researchers noted possible residual concerns involving IPv6 loopback handling and abuse from other local applications.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
A public proof of concept for CVE-2026-49471 was reported in the later write-up, demonstrating exploitability of the Serena DNS rebinding and memory poisoning chain. The same write-up also noted residual concerns around IPv6 loopback handling and localhost-origin abuse.
On 2026-07-07, CVE-2026-59706 was published as a critical mem0 vulnerability involving unauthenticated configuration endpoints. The flaw allows plaintext retrieval of stored API keys and SSRF via modification of the ollama_base_url parameter.
On 2026-07-07, CVE-2026-49471 was published as a high-severity Serena vulnerability that can lead to remote code execution via DNS rebinding, memory poisoning, and shell command execution. Affected versions are prior to 1.5.2.
Serena addressed CVE-2026-49471 in version 1.5.2. The fix adds Flask Host header validation to restrict dashboard requests to localhost or 127.0.0.1 on the active port.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
cvereports.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
NLnet Labs has addressed multiple vulnerabilities in the **Unbound** DNS resolver, including **`CVE-2026-33278`**, a high-severity flaw in the DNSSEC validator that can cause denial of service and potentially **remote code execution**. The bug affects Unbound versions **`1.19.1` through `1.25.0`** and stems from a deep-copy error that overwrites a destination pointer, later triggering a dangling-pointer dereference. The issue is tracked under **`CWE-416`** and **`CWE-672`** and carries high potential impact to confidentiality, integrity, and availability. Exploitation requires an attacker to control a malicious signed DNS zone and induce a vulnerable Unbound instance to query it while a **DS sub-query** is suspended because of **NSEC3 computational budget exhaustion**. Belgium's Centre for Cybersecurity warned that the Unbound vulnerabilities could enable denial-of-service and urged organizations to patch immediately. The vendor has fixed the issue in **Unbound `1.25.1`**, making upgrade a priority for operators using affected resolver versions.
Jun 29, 2026
A critical vulnerability tracked as **CVE-2026-1961** was disclosed in Foreman’s WebSocket proxy, where unsanitized hostname values in `lib/ws_proxy.rb` are used to build shell commands. A malicious compute resource provider—such as a fake VMware vSphere or Libvirt endpoint—can exploit the flaw to trigger **remote code execution** on the Foreman server when an administrator opens a VM console. The issue affects **Foreman 3.17.0 and earlier** and likely older releases because the vulnerable code path reportedly remained unchanged since 2020. Successful exploitation can execute code as the `foreman` user, creating a path to steal database credentials and encryption keys and potentially decrypt stored infrastructure secrets for wider compromise of managed environments. The proposed fix replaces shell-interpreted command construction with safer handling using `Shellwords.escape`, array-based arguments, and `Open3.popen3`, while Red Hat said the issue was addressed in **Red Hat Satellite 6.17 for RHEL 9** and **Red Hat Satellite 6.16 for RHEL 8 and RHEL 9** through advisories `RHSA-2026:5970` and `RHSA-2026:5971`.
Aug 20, 2026
A high-severity server-side request forgery flaw tracked as **`CVE-2026-72777`** affects **Next AI Draw.io** through version **`0.4.16`**, allowing unauthenticated remote attackers to access internal HTTP services through the application's **`POST /api/parse-url`** endpoint. The issue stems from hostname validation in `isPrivateUrl()` that relies on string-based checks instead of resolving DNS, enabling attackers to supply hostnames that appear external but resolve to localhost, RFC1918 addresses, or cloud metadata endpoints. Researchers reported that the endpoint fetches attacker-supplied URLs server-side and returns extracted content, making it possible to exfiltrate responses from internal-only services. The disclosed bypass techniques include **DNS rebinding**, attacker-controlled DNS, and redirect chains; one proof of concept used a hostname such as `127-0-0-1.sslip.io` to read data from a service bound only to **`127.0.0.1:9099`**. The vulnerability carries a **CVSS 3.1 score of 8.6**, and recommended mitigations include upgrading to a patched release, validating destinations after DNS resolution, blocking redirects into private address space, and restricting server access to internal network resources.
Aug 14, 2026