MCPJam Inspector Authorized Security Validator

A bounded proof-of-concept validator for CVE-2026-23744 affecting vulnerable MCPJam Inspector deployments.

This project is an independent, non-destructive validation tool for the previously disclosed CVE-2026-23744. It is not the original vulnerability disclosure or exploit.

This repository is intended for security professionals validating systems they own or have explicit written authorization to assess.

Important Notice

This validator confirms exposure by causing the target MCPJam Inspector process to execute a fixed, non-interactive evidence command. It does not provide a general-purpose exploit framework, shell, post-exploitation workflow, persistence mechanism, credential access routine, or privilege-escalation capability.

Run this tool only against assets you own or have explicit written permission to test. Unauthorized testing may violate laws, contracts, acceptable-use policies, or rules of engagement.

Vulnerability Summary

• CVE: CVE-2026-23744
• Advisory: GHSA-232v-j27c-5pp6
• Affected product: MCPJam Inspector
• Affected versions: Up to and including 1.4.2
• Fixed version: 1.4.3
• Vulnerability class: Unauthenticated remote command execution
• Affected endpoint: /api/mcp/connect
• Impact: A remote unauthenticated attacker may be able to cause the vulnerable MCPJam Inspector service to launch an attacker-controlled MCP server process.

Purpose

The purpose of this repository is to provide a safe, bounded, and auditable validation workflow for authorized security assessments.

It is designed to help defenders, asset owners, consultants, and internal security teams determine whether a specific MCPJam Inspector deployment is still vulnerable to CVE-2026-23744 without performing unnecessary destructive actions or collecting sensitive data.

Safety Properties

This validator is intentionally constrained:

• Requires an operator-supplied target.
• Requires the --authorized acknowledgement before running.
• Executes only a fixed, non-destructive evidence command.
• Does not accept arbitrary operating-system commands from the CLI.
• Does not establish an interactive shell.
• Does not access credentials.
• Does not read sensitive application data.
• Does not create persistence.
• Does not attempt privilege escalation.
• Does not attempt lateral movement.
• Caps returned evidence to reduce accidental data exposure.
• Removes the temporary MCP session after validation.
• Produces structured JSON output suitable for assessment records.
• Contains no customer, lab, credential, or target-specific data.

What the Validator Does

At a high level, the validator:

1. Checks that the operator has supplied the required authorization flag.
2. Connects to the target MCPJam Inspector endpoint.
3. Attempts to create a temporary MCP server session using a fixed local responder.
4. Requests a fixed evidence command from that temporary session.
5. Captures limited evidence returned by the target service.
6. Deletes the temporary MCP session.
7. Prints or writes a structured JSON assessment result.

The evidence command is intentionally limited to basic runtime context such as identity, hostname, working directory, and kernel information. It is intended only to prove code execution under the MCPJam Inspector service account.

What the Validator Does Not Do

This tool does not:

• Provide arbitrary command execution to the operator.
• Provide a reverse shell or bind shell.
• Download or execute external payloads.
• Read files from the target.
• Dump environment variables.
• Collect tokens, secrets, cookies, SSH keys, or credentials.
• Modify system configuration.
• Install software.
• Create users.
• Change permissions.
• Attempt privilege escalation.
• Attempt persistence.
• Attempt lateral movement.
• Attempt data exfiltration.

Requirements

• Python 3.9 or later on the assessment workstation.
• Network access from the assessment workstation to the MCPJam Inspector service.
• Authorization to test the target system.
• Target-side MCP server execution environment must support the command used by the validator.

The validator is designed for authorized assessment environments and should be executed from a trusted administrative workstation.

Installation

Clone the repository:

git clone https://github.com/kennedy-aikohi/mcpjam-cve-2026-23744-validator.git
cd mcpjam-cve-2026-23744-validator

No third-party Python dependencies are required.

Usage

Basic validation:

python mcpjam_authorized_validator.py \
  --target http://inspector.example.internal:6274 \
  --authorized

Write a JSON report to disk:

python mcpjam_authorized_validator.py \
  --target http://inspector.example.internal:6274 \
  --authorized \
  --output assessment-result.json

Example target formats:

http://127.0.0.1:6274
http://inspector.example.internal:6274
https://inspector.example.internal

Required Authorization Flag

The --authorized flag is required by design.

Example:

python mcpjam_authorized_validator.py --target http://127.0.0.1:6274 --authorized

Without this flag, the validator exits and does not run the assessment.

This is an intentional safeguard to ensure the operator explicitly acknowledges that they are authorized to test the target.

Exit Codes

The validator uses exit codes that are useful for CI pipelines and automated security checks:

Exit Code	Meaning
0	Vulnerability was not validated
1	Vulnerability was validated
2	Invalid arguments, missing authorization acknowledgement, or usage error

A return code of 1 does not mean the validator crashed. It means the target appears vulnerable and the result should be treated as a security finding.

Output Format

The validator returns structured JSON similar to the following:

{
  "timestamp_utc": "2026-06-09T13:00:00Z",
  "target": "http://inspector.example.internal:6274",
  "endpoint": "/api/mcp/connect",
  "authorized": true,
  "vulnerable": true,
  "http_status": 200,
  "evidence": {
    "identity": "uid=1000(mcpjam) gid=1000(mcpjam)",
    "hostname": "inspector-host",
    "working_directory": "/app",
    "kernel": "Linux 6.x"
  },
  "error": null
}

Exact fields may vary depending on the target behavior, network conditions, and service response.

Interpreting Results

Vulnerable Result

A vulnerable result means the unauthenticated MCP connection endpoint launched the validator's fixed process and returned evidence.

Treat this as remote code execution under the MCPJam Inspector service account.

Recommended response:

1. Record the JSON output as assessment evidence.
2. Confirm the exposed service owner and business context.
3. Restrict access to the service immediately if it is reachable from an untrusted network.
4. Upgrade MCPJam Inspector to a fixed version.
5. Review service logs for unexpected requests to /api/mcp/connect.
6. Review service-account permissions.
7. Rotate secrets if there is reason to believe the service account had access to sensitive material.

Non-Vulnerable Result

A non-vulnerable result means the validator did not confirm execution.

This may indicate:

• The target is patched.
• The target is not MCPJam Inspector.
• The endpoint is not reachable.
• The service is protected by network controls.
• The service behavior differs from the vulnerable versions.
• The target environment does not support the validator's fixed responder.