MCPJam Inspector Authorized Security Validator

A bounded proof-of-concept validator for CVE-2026-23744 affecting vulnerable MCPJam Inspector deployments.

This project is an independent, non-destructive validation tool for the previously disclosed CVE-2026-23744. It is not the original vulnerability disclosure or exploit.

This repository is intended for security professionals validating systems they own or have explicit written authorization to assess.

Important Notice

This validator confirms exposure by causing the target MCPJam Inspector process to execute a fixed, non-interactive evidence command. It does not provide a general-purpose exploit framework, shell, post-exploitation workflow, persistence mechanism, credential access routine, or privilege-escalation capability.

Run this tool only against assets you own or have explicit written permission to test. Unauthorized testing may violate laws, contracts, acceptable-use policies, or rules of engagement.

Vulnerability Summary

• CVE: CVE-2026-23744
• Advisory: GHSA-232v-j27c-5pp6
• Affected product: MCPJam Inspector
• Affected versions: Up to and including 1.4.2
• Fixed version: 1.4.3
• Vulnerability class: Unauthenticated remote command execution
• Affected endpoint: /api/mcp/connect
• Impact: A remote unauthenticated attacker may be able to cause the vulnerable MCPJam Inspector service to launch an attacker-controlled MCP server process.

Purpose

The purpose of this repository is to provide a safe, bounded, and auditable validation workflow for authorized security assessments.

It is designed to help defenders, asset owners, consultants, and internal security teams determine whether a specific MCPJam Inspector deployment is still vulnerable to CVE-2026-23744 without performing unnecessary destructive actions or collecting sensitive data.

Safety Properties

This validator is intentionally constrained:

• Requires an operator-supplied target.
• Requires the --authorized acknowledgement before running.
• Executes only a fixed, non-destructive evidence command.
• Does not accept arbitrary operating-system commands from the CLI.
• Does not establish an interactive shell.
• Does not access credentials.
• Does not read sensitive application data.
• Does not create persistence.
• Does not attempt privilege escalation.
• Does not attempt lateral movement.
• Caps returned evidence to reduce accidental data exposure.
• Removes the temporary MCP session after validation.
• Produces structured JSON output suitable for assessment records.
• Contains no customer, lab, credential, or target-specific data.

What the Validator Does

At a high level, the validator:

1. Checks that the operator has supplied the required authorization flag.
2. Connects to the target MCPJam Inspector endpoint.
3. Attempts to create a temporary MCP server session using a fixed local responder.
4. Requests a fixed evidence command from that temporary session.
5. Captures limited evidence returned by the target service.
6. Deletes the temporary MCP session.
7. Prints or writes a structured JSON assessment result.

The evidence command is intentionally limited to basic runtime context such as identity, hostname, working directory, and kernel information. It is intended only to prove code execution under the MCPJam Inspector service account.

What the Validator Does Not Do

This tool does not:

• Provide arbitrary command execution to the operator.
• Provide a reverse shell or bind shell.
• Download or execute external payloads.
• Read files from the target.
• Dump environment variables.
• Collect tokens, secrets, cookies, SSH keys, or credentials.
• Modify system configuration.
• Install software.
• Create users.
• Change permissions.
• Attempt privilege escalation.
• Attempt persistence.
• Attempt lateral movement.
• Attempt data exfiltration.

Requirements

• Python 3.9 or later on the assessment workstation.
• Network access from the assessment workstation to the MCPJam Inspector service.
• Authorization to test the target system.
• Target-side MCP server execution environment must support the command used by the validator.

The validator is designed for authorized assessment environments and should be executed from a trusted administrative workstation.

Installation

Clone the repository:

git clone https://github.com/kennedy-aikohi/mcpjam-cve-2026-23744-validator.git
cd mcpjam-cve-2026-23744-validator

No third-party Python dependencies are required.

Usage

Basic validation:

python mcpjam_authorized_validator.py \
  --target http://inspector.example.internal:6274 \
  --authorized

Write a JSON report to disk:

python mcpjam_authorized_validator.py \
  --target http://inspector.example.internal:6274 \
  --authorized \
  --output assessment-result.json

Example target formats:

http://127.0.0.1:6274
http://inspector.example.internal:6274
https://inspector.example.internal

Required Authorization Flag

The --authorized flag is required by design.

Example:

python mcpjam_authorized_validator.py --target http://127.0.0.1:6274 --authorized

Without this flag, the validator exits and does not run the assessment.

This is an intentional safeguard to ensure the operator explicitly acknowledges that they are authorized to test the target.

Exit Codes

The validator uses exit codes that are useful for CI pipelines and automated security checks:

A return code of 1 does not mean the validator crashed. It means the target appears vulnerable and the result should be treated as a security finding.

Output Format

The validator returns structured JSON similar to the following:

{
  "timestamp_utc": "2026-06-09T13:00:00Z",
  "target": "http://inspector.example.internal:6274",
  "endpoint": "/api/mcp/connect",
  "authorized": true,
  "vulnerable": true,
  "http_status": 200,
  "evidence": {
    "identity": "uid=1000(mcpjam) gid=1000(mcpjam)",
    "hostname": "inspector-host",
    "working_directory": "/app",
    "kernel": "Linux 6.x"
  },
  "error": null
}

Exact fields may vary depending on the target behavior, network conditions, and service response.

Interpreting Results

Vulnerable Result

A vulnerable result means the unauthenticated MCP connection endpoint launched the validator's fixed process and returned evidence.

Treat this as remote code execution under the MCPJam Inspector service account.

Recommended response:

1. Record the JSON output as assessment evidence.
2. Confirm the exposed service owner and business context.
3. Restrict access to the service immediately if it is reachable from an untrusted network.
4. Upgrade MCPJam Inspector to a fixed version.
5. Review service logs for unexpected requests to /api/mcp/connect.
6. Review service-account permissions.
7. Rotate secrets if there is reason to believe the service account had access to sensitive material.

Non-Vulnerable Result

A non-vulnerable result means the validator did not confirm execution.

This may indicate:

• The target is patched.
• The target is not MCPJam Inspector.
• The endpoint is not reachable.
• The service is protected by network controls.
• The service behavior differs from the vulnerable versions.
• The target environment does not support the validator's fixed responder.

A non-vulnerable result should not be treated as a full security assessment by itself. Confirm version, exposure, authentication requirements, and network access controls separately.

Operational Guidance

Before running the validator:

1. Confirm written authorization.
2. Confirm the target hostname, IP address, and port.
3. Confirm testing window and rules of engagement.
4. Confirm whether the service is production, staging, or lab infrastructure.
5. Notify stakeholders if required by the engagement process.

After running the validator:

1. Save the JSON output.
2. Capture the exact command used.
3. Record the assessment timestamp in UTC.
4. Record the source IP address used for validation.
5. Preserve relevant service logs.
6. Document remediation actions and owner assignment.

Recommended Report Language

If the validator confirms exposure, the finding may be described as:

The MCPJam Inspector service was confirmed vulnerable to CVE-2026-23744.
During authorized validation, the unauthenticated /api/mcp/connect endpoint
caused the service to launch a fixed, non-destructive evidence command and
return runtime context. This confirms remote code execution under the MCPJam
Inspector service account. No privilege escalation, credential access,
persistence, lateral movement, or sensitive data access was attempted.

Remediation

Recommended remediation steps:

1. Upgrade MCPJam Inspector to version 1.4.3 or later.
2. Remove public or untrusted-network access to the Inspector service.
3. Bind administrative tooling to 127.0.0.1 or a trusted management interface.
4. Require authentication and authorization before process-launch operations.
5. Place the service behind a trusted VPN, bastion, or administrative network.
6. Restrict inbound access at host firewall, security group, and network ACL layers.
7. Review service-account permissions and reduce privileges where possible.
8. Rotate potentially exposed secrets if the service account had access to sensitive material.
9. Inspect logs for unexpected requests to /api/mcp/connect.
10. Monitor for suspicious child processes spawned by the MCPJam Inspector service.

Detection Ideas

Defenders may review the following telemetry sources:

• HTTP access logs for requests to /api/mcp/connect.
• Process creation logs from the MCPJam Inspector host.
• Unexpected child processes spawned by the Inspector service.
• Network connections from the Inspector host to untrusted destinations.
• New or unusual MCP server sessions.
• Administrative service exposure on 0.0.0.0.
• Firewall logs showing access to the Inspector port from untrusted networks.

Example detection logic:

Look for unauthenticated or unexpected requests to /api/mcp/connect followed by
new child processes spawned by the MCPJam Inspector service account.

Limitations

This validator is intentionally limited and should not be treated as a complete security scanner.

Known limitations:

• It validates one vulnerability class only.
• It does not perform version fingerprinting as a sole source of truth.
• It does not test post-exploitation impact.
• It does not validate every possible MCPJam Inspector deployment configuration.
• It may return a false negative if network controls, service behavior, runtime environment, or response formatting prevent evidence collection.
• It may fail if the target-side execution environment lacks the expected interpreter or runtime behavior.
• It does not replace patch verification, log review, or configuration review.

Security Design Notes

The validator is designed to be auditable and constrained.

Important implementation choices:

• The operator cannot supply arbitrary commands.
• The evidence command is fixed in the source code.
• Returned evidence is capped.
• The tool requires explicit authorization acknowledgement.
• Temporary MCP session cleanup is attempted after validation.
• JSON output supports repeatable assessment records.
• CI-friendly exit codes allow defenders to fail builds or checks when exposure is confirmed.

Responsible Use

Use only against assets you own or have explicit permission to test.

Users are responsible for complying with applicable laws, contracts, internal policies, and rules of engagement.

Do not use this tool for unauthorized testing, internet-wide scanning, credential access, persistence, privilege escalation, data theft, or disruption.

Attribution

This repository is an independent authorized-validation project.

It is not the original vulnerability disclosure, vendor advisory, or exploit release.

Primary references:

• GitHub Security Advisory: https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6
• NVD CVE Record: https://nvd.nist.gov/vuln/detail/CVE-2026-23744
• GitHub Advisory Database: https://github.com/advisories/GHSA-232v-j27c-5pp6

License

This project is released under the license included in this repository.

Maintainer Notes

Recommended repository hygiene:

• Keep the validator non-destructive.
• Do not add arbitrary command execution flags.
• Do not add reverse shell functionality.
• Do not add credential access functionality.
• Do not include real target data in examples.
• Keep assessment output bounded.
• Keep authorization language visible in the README and CLI help.
• Keep references to the original advisory and NVD record.