CVE-2026-49471

Name of the Vulnerable Software and Affected Versions Serena versions prior to 1.5.2

Description The built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port. This API lacks authentication, Cross-Site Request Forgery (CSRF) protection, and Host header validation. A DNS rebinding attack—a technique that bypasses the Same-Origin Policy by changing the IP address associated with a domain name—allows a malicious webpage to access this API via a browser. This enables an attacker to write arbitrary content to the agent's persistent memory store. When combined with the execute shell command() function using shell=True, this sequence allows for remote code execution if a user visits a malicious webpage while the software is running.

Recommendations Update to version 1.5.2.