CVE-2026-23744

CRITICAL9.8

REC in MCPJam inspector due to HTTP Endpoint exposes

Published Jan 16, 2026

Modified 3 days ago

Details

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

References

WEBhttps://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a WEBhttps://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2026-23744

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

Authentication

CWE-306

Missing Authentication

Ecosystems

Timeline

PublishedJan 16, 2026

ModifiedJan 16, 2026