PT-2026-3321 · Unknown · Mcpjam Inspector

C2An1 · Published 2026-01-16 · Updated 2026-05-31 · CVE-2026-23744

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCPJam inspector versions prior to 1.4.3

Description MCPJam inspector, a local-first development platform for MCP servers, contains a flaw that allows remote code execution (RCE). The software by default listens on 0.0.0.0 instead of 127.0.0.1, making its HTTP APIs remotely reachable. An attacker can send a crafted HTTP request to the '/api/mcp/connect' endpoint, which extracts the command and args variables without security checks, triggering the installation of an MCP server and leading to arbitrary command execution without user interaction.

Recommendations Update to version 1.4.3. Restrict access to the '/api/mcp/connect' endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-23744

GHSA-232V-J27C-5PP6

Affected Products

Mcpjam Inspector

References · 26

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23744.json · Exploit
• https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 · Vendor Advisory
• https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a · Patch
• https://osv.dev/vulnerability/CVE-2026-23744 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23744 · Security Note
• https://osv.dev/vulnerability/GHSA-232v-j27c-5pp6 · Vendor Advisory
• https://github.com/MCPJam/inspector · Note
• https://twitter.com/LSystemsMx/status/2048183954386153605 · Twitter Post
• https://twitter.com/pulsepatchio/status/2012531241111994593 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2014138617380171806 · Twitter Post
• https://twitter.com/CVEnew/status/2012303183222382830 · Twitter Post
• https://twitter.com/Sattyamjjain/status/2048052595172978800 · Twitter Post
• https://twitter.com/CveFindCom/status/2012263380183076886 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2042996125200695362 · Twitter Post
• https://twitter.com/Sadishyt/status/2038300655522316704 · Twitter Post