Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-23744 — Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+). | Kitploit
Tools/GitHubGitHub/nullroot-red/cve-2026-23744
Payload GenerationVulnerability AnalysisExploitationWeb Application ExploitationPenetration TestingLearning & Education
GitHubnullroot-red/cve-2026-23744

CVE-2026-23744

Proof-of-concept and offensive security research analyzing CVE-2026-23744 (MCPJam Inspector Unauthenticated RCE, Patched in v1.4.3+).

View Repository
13 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-23744: Unauthenticated Remote Code Execution PoC

DISCLAIMER: This repository and the associated scripts are intended solely for authorized security assessments, penetration testing, security research, and educational analysis. Unauthorized testing of systems without explicit written consent is illegal and strictly prohibited. The author assumes no liability for misinterpretation or misuse of this material.

Overview

This repository contains a Proof-of-Concept (PoC) automation script demonstrating CVE-2026-23744, a critical-severity vulnerability (CVSS 9.8) affecting @mcpjam/inspector (versions <= 1.4.2).

The vulnerability stems from Missing Authentication for a Critical Function (CWE-306) combined with an insecure default network binding. By default, the MCPJam Inspector interface binds to 0.0.0.0 rather than 127.0.0.1, exposing the exposed HTTP API control plane to the local network or the internet. Remote threat actors can exploit the unauthenticated /api/mcp/connect endpoint by transmitting a crafted JSON payload containing arbitrary operating system commands inside the serverConfig object, leading to full context Remote Code Execution (RCE).

Technical Flow

The automated assessment tool implements the following logical methodology:

  1. Target Verification (ICMP Handshake): Evaluates host availability before initializing the network payload sequence to prevent socket errors or execution hanging.
  2. Listener Initialization: Spawns a controlled handler to intercept the incoming reverse shell connection.
  3. Payload Construction: Assembles a JSON configuration payload, embedding a dynamically base64-encoded callback string to avoid character escaping boundaries during remote parsing.
  4. Exploitation Vector: Transmits an unauthenticated HTTP POST request to the target's exposed orchestration interface (/api/mcp/connect), forcing the application runtime to drop down to the shell layer and execute the payload.

Architecture Components

  • exploit.py: The core automation framework handling host state checks, payload encoding, and HTTP interaction.
  • Target Interface: /api/mcp/connect
  • Impact: Full administrative access under the context of the user running the MCPJam Inspector process (typically a developer workstation or build server).

Prerequisites & Usage

Ensure your environment is properly provisioned with Python 3.x before running the assessment framework.

Installation

root@kitploit:~
git clone https://github.com/<your-username>/CVE-2026-23744.git
cd CVE-2026-23744
python3 exploit.py -t <target_ip> -api <target_api> -user <user_ip>

or with custom port

python3 exploit.py -t <target_ip> -api <target_api> -user <user_ip> -p <target_port>
Download Tool