PT-2026-3321 · Unknown · Mcpjam Inspector

C2An1 · CVE-2026-23744 · Published 2026-01-16 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCPJam inspector versions prior to 1.4.3

Description MCPJam inspector is a local-first development platform for MCP servers. The software is susceptible to remote code execution (RCE) because it binds to 0.0.0.0 by default instead of 127.0.0.1, making its HTTP APIs remotely accessible. An attacker can send a crafted HTTP request to the '/api/mcp/connect' endpoint, which is intended for connecting to MCP servers. The system extracts the command and args variables from the request without performing security checks, allowing the execution of arbitrary commands on the target system.

Recommendations Update to version 1.4.3. Restrict access to the '/api/mcp/connect' endpoint to minimize the risk of exploitation.

Exploit

Fix

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-23744

GHSA-232V-J27C-5PP6

Affected Products

Mcpjam Inspector

References · 32

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23744.json · Exploit
• 🔥 https://exploit-db.com/exploits/52625 · Exploit
• https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 · Vendor Advisory
• https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23744 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23744 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-232v-j27c-5pp6 · Vendor Advisory
• https://github.com/MCPJam/inspector · Note
• https://twitter.com/RicardGardella/status/2063664840007209074 · Twitter Post
• https://twitter.com/DarkWebInformer/status/2014138617380171806 · Twitter Post
• https://twitter.com/NexusVoid_Ai/status/2064201622583201883 · Twitter Post
• https://twitter.com/CveFindCom/status/2012263380183076886 · Twitter Post
• https://twitter.com/Sadishyt/status/2038300655522316704 · Twitter Post
• https://twitter.com/0xSubrat/status/2061150709794672888 · Twitter Post
• https://twitter.com/momika233/status/2013155447818059854 · Twitter Post