CVE-2026-23744

High PUBLISHED

REC in MCPJam inspector due to HTTP Endpoint exposes

MCPJam · inspector

Not yet in CISA KEV

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

High

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

Not yet in CISA KEV

CVSS / EPSS

9.8 Critical

At a Glance

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

nuclei_scanner

CVE Published: Jan 16, 2026
Exploitation Reported: Apr 03, 2026
CVSS: 9.8 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
MCPJam	inspector	<= 1.4.2	Affected

CVE References

https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 github.com · CVE Record https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27...
https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a github.com · CVE Record https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bd...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
The Shadowserver First	2026-04-03 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23744.yaml	Jun 01, 2026

CVSS Scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2026-04-03 00:00:00 UTC · The Shadowserver

Proof of concept available

Recorded 2026-03-29 16:26:01 UTC · GitHub

Weaknesses (CWE)

CWE-306

Missing Authentication for Critical Function

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-23744.yaml	Jun 01, 2026

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

CerberusMrXi/CVE-2026-23744-MCPJam-Exploit

github · Created 2026-07-14 18:21:10 UTC · 0 stars

A proof-of-concept exploit for CVE-2026-23744 - MCPJam Inspector Remote Code Execution (RCE) vulnerability. This tool demonstrates the security flaw in versions <=1.4.2 and helps security researchers verify patches. For authorized testing and educational purposes only. Includes multiple payload options, command execution, and session management.

ozcanpng/CVE-2026-23744

github · Created 2026-07-11 11:57:38 UTC · 0 stars

CVE-2026-23744 MCPJam Inspector unauthenticated RCE PoC

0x77FSec/CVE-2026-23744

github · Created 2026-07-10 07:39:22 UTC · 0 stars

diamorphine666/CVE-2026-23744-exploit

github · Created 2026-07-04 20:53:38 UTC · 0 stars

Exploit for MCPJam Inspector - Remote Code Execution (CVE-2026-23744)

oryk0/CVE-2026-23744

github · Created 2026-06-06 04:57:39 UTC · 0 stars

CVE-2026-23744 Reverse shell

keeieb79/CVE-2026-23744-poc

github · Created 2026-06-05 07:27:43 UTC · 0 stars

cve-2026-23744 python exploit

Dahalsamir/CVE-2026-23744-MCPJAM-RCE-exploit

github · Created 2026-06-05 05:19:26 UTC · 0 stars

This Python proof-of-concept targets a vulnerable MCP (Model Context Protocol) service exposed by the target application. The vulnerability allows an attacker to supply arbitrary server configuration parameters through the /api/mcp/connect endpoint.

avivyap/CVE-2026-23744

github · Created 2026-06-04 16:29:39 UTC · 0 stars

CVE-2026-23744

MrR0b0t19/CVE-2026-23744-PoC

github · Created 2026-06-02 23:19:04 UTC · 0 stars

TYehan/CVE-2026-23744

github · Created 2026-06-02 16:57:56 UTC · 0 stars

Proof of Concept exploit for CVE-2026-23744: Remote Code Execution vulnerability in MCPJam Inspector <= 1.4.2

m2sousa/CVE-2026-23744

github · Created 2026-06-02 04:34:01 UTC · 0 stars

CVE-2026-23744 Proof-of-concept.

alisster00/CVE-2026-23744-RCE

github · Created 2026-06-02 02:25:52 UTC · 1 stars

This utility was created during research involving MCPJam v1.4.2. The application exposes an API endpoint that accepts a server configuration object. Under certain conditions, insufficient validation may allow unintended command execution.

afifudinmtop/MCPJam-Inspector-1.4.2-Remote-Code-Execution-CVE-2026-23744

github · Created 2026-06-01 03:21:12 UTC · 0 stars

Least-Significant-Bit/CVE-2026-23744

github · Created 2026-05-31 19:17:49 UTC · 0 stars

Remote Code Execution in MCPJam 1.4.2 and older.

sbouabid-sec/CVE-2026-23744-POC

github · Created 2026-05-31 17:27:37 UTC · 0 stars

CVE-2026-23744 — Proof of concept exploit for an unauthenticated Remote Code Execution vulnerability in MCPJam Inspector <= 1.4.2.

SrGinebras/CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

github · Created 2026-05-31 12:10:47 UTC · 1 stars

p1ctur3p3rf3ct/CVE-2026-23744

github · Created 2026-05-31 02:11:26 UTC · 0 stars

CVE-2026-23744 PoC

CyLock11/CVE-2026-23744

github · Created 2026-03-29 16:26:01 UTC · 1 stars

CVE-2026-23744 - MCP Connect RCE via Unauthenticated Command Injection

d3vn0mi/CVE-2026-23744-POC

github · Created 2026-03-28 12:17:47 UTC · 0 stars

0xg00se/CVE-2026-23744-script

github · Created 2026-03-27 15:57:26 UTC · 1 stars

Exploit script for CVE-2026-23744

fcjaviergarcia/CVE-2026-23744-POC

github · Created 2026-03-27 15:31:08 UTC · 0 stars

Proof of Concept (PoC) exploit for CVE-2026-23744, a vulnerability affecting MCPJam Inspector that allows remote command execution (RCE) through exposed internal debugging endpoints

AhmadF77/CVE-2026-23744

github · Created 2026-03-27 14:14:14 UTC · 0 stars

python script for exploiting CVE-2026-23744

ctzisme/CVE-2026-23744

github · Created 2026-03-26 16:21:22 UTC · 1 stars

PoC for CVE-2026-23744, demonstrating an unauthenticated RCE in MCPJam Inspector (<= 1.4.2).

z4yd3/PoC-CVE-2026-23744

github · Created 2026-03-25 02:24:21 UTC · 0 stars

Remote Code Execution on MCPJam Inspector <= 1.4.2

InzegoSec/CVE-2026-23744

github · Created 2026-03-24 19:18:14 UTC · 0 stars

Exploit to MCPJam Inspector <=1.4.2

FrenzisRed/CVE-2026-23744

github · Created 2026-03-23 18:38:28 UTC · 2 stars

CVE-2026-23744 - MCPJam inspector Remote-Code-Execution: Proof Of Concept (POC

H1sok444/CVE-2026-23744-PoC

github · Created 2026-03-22 02:53:22 UTC · 0 stars

suljov/CVE-2026-23744-Remote-Code-Execution-POC

github · Created 2026-03-21 22:33:03 UTC · 6 stars

MCPJam inspector contains a remote code execution

rootdirective-sec/CVE-2026-23744-Lab

github · Created 2026-02-16 04:43:21 UTC · 0 stars

ibreakthingsforaliving/CVE-2026-23744-PoC

github · Created 2026-01-20 06:55:53 UTC · 9 stars

CVE-2026-23744 - Versions 1.4.2 and earlier of MCPJam inspector are vulnerable to remote code execution (RCE). Because the tool listens on 0.0.0.0 by default, an attacker can trigger the installation and execution of a malicious MCP server by sending a crafted HTTP request. Version 1.4.3 contains a patch for this issue.

boroeurnprach/CVE-2026-23744-PoC

github · Created 2026-01-20 06:55:53 UTC · 8 stars

MCPJam Inspector - Remote Code Execution

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2026-23744

{
  "cve_id": "CVE-2026-23744",
  "title": "REC in MCPJam inspector due to HTTP Endpoint exposes",
  "affected_vendor": "MCPJam",
  "affected_product": "inspector",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "High",
  "cvss_score": 9.8,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2026-23744

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API