CVE-2026-23744

CVE-2026-23744 · REC in MCPJam inspector due to HTTP Endpoint exposes

This page contains facts from public vulnerability sources. Check the original advisory before updating.

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

CVSS 9.8 · Critical · EPSS 67.5% · Public exploit · Fix available

Published

2026-01-16T20:10:37.458Z

Updated

2026-01-16T21:15:53.738Z

Stack: node

Check your server →