Security2026-09-14 · source-backed

A coding-agent MCP server binding 0.0.0.0, and the docs recommended it.

Issue

2026-09-14

Confidence

source-backed

Sources

Redaction

redacted

Story

CVE-2026-38924 scores 2.9 LOW, which understates it. Oraios AI Serena before 1.0.0 listens on all interfaces in HTTP mode, and the NVD note records that the supplier called 0.0.0.0 a hazard while its own documentation recommended it. Low severity on paper, but it turns a local agent tool into something anyone on your coffee-shop wifi can drive.

GitSpawn: opening a folder is enough to run attacker code in seven coding agents
The trick is one line in a file you never read. Manifold Security published eight findings across seven coding agents (Claude Code, Codex, Cursor, Grok Build, Qwen Code, goose, Hermes Agent) that all reduce to the same mechanism. A repository's own .git/config sets core.fsmoni...
A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It
Someone opens a PR against your repo. The description looks normal in the browser. Buried in it is . Invisible in the Azure DevOps web UI. Fully visible to your review ag...
MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth
The Model Context Protocol has a security problem that's no longer theoretical — it's statistical. Between January and February 2026, researchers filed 30+ CVEs against MCP servers, clients, and infrastructure. One package with nearly 500,000 downloads carried a CVSS 9.6 RCE....
Epic put an MCP server inside the Unreal Editor, and now Claude can drive a game engine
MCP has been escaping the IDE for a while. This is the moment it left for somewhere genuinely new. On June 17 at Unreal Fest Chicago, Epic shipped Unreal Engine 5.8 with an experimental MCP server embedded directly in the Editor process. Any MCP-compatible agent, Claude Code,...
MCP drops session IDs, Terraform hits a CVSS 10.0
Ten days from spec to shipped client. That's fast even for this ecosystem. The MCP 2026-07-28 revision replaced the bidirectional stateful protocol with request/response. Every request now independently carries protocol version, client identity and capabilities. Cloudflare's t...
MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.
The defense-first MCP pattern from Christian Schneider treats every tool schema like a request from a stranger. A control point outside the client runs a five-stage validation pipeline. Stages 01 through 04 gate the discovery path, inspecting every schema before the model ever...

Source trail

CVE-2026-38924 More from nvd.nist.gov

Entities

CVE HTTP LOW MCP NVD Oraios AI Serena

Provenance

Canonical issue: Ramsay Research Agent — September 14, 2026
AI generated: no
Story unit: 2026-09-14-a-coding-agent-mcp-server-binding-0-0-0-0-and-the-docs-recommended-it
Labels: source-backed, canonical briefing excerpt

Fetching from the wire…

A coding-agent MCP server binding 0.0.0.0, and the docs recommended it.

Story

Related stories

GitSpawn: opening a folder is enough to run attacker code in seven coding agents

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

Epic put an MCP server inside the Unreal Editor, and now Claude can drive a game engine

MCP drops session IDs, Terraform hits a CVSS 10.0

MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.

Source trail

Entities

Provenance

A coding-agent MCP server binding 0.0.0.0, and the docs recommended it.

Story

Related stories

GitSpawn: opening a folder is enough to run attacker code in seven coding agents

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

Epic put an MCP server inside the Unreal Editor, and now Claude can drive a game engine

MCP drops session IDs, Terraform hits a CVSS 10.0

MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.

Source trail

Entities

Provenance

Story

Related stories

GitSpawn: opening a folder is enough to run attacker code in seven coding agents

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

Epic put an MCP server inside the Unreal Editor, and now Claude can drive a game engine

MCP drops session IDs, Terraform hits a CVSS 10.0

MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance

Story

Related stories

GitSpawn: opening a folder is enough to run attacker code in seven coding agents

A Hidden HTML Comment in a Pull Request Owns Your Review Agent, and Microsoft Hasn't Patched It

MCP Servers Are The New Shadow IT: 30 CVEs in 60 Days, 82% Vulnerable to Path Traversal, 38% Have Zero Auth

Epic put an MCP server inside the Unreal Editor, and now Claude can drive a game engine

MCP drops session IDs, Terraform hits a CVSS 10.0

MCP tool discovery is untrusted HTTP ingress, so put a gateway in front of it.

Tomorrow's issue, in your inbox.

Source trail

Entities

Provenance