What’s Vulnerable › Vulnerabilities

CVE-2026-23744: REC in MCPJam inspector due to HTTP Endpoint exposes

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 67.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-16 · updated 2026-06-17
• Weakness: CWE-306

Description

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

Affected products

• MCPJam inspector: before 1.4.3 — fixed in 1.4.3

How to fix

Upgrade to a fixed version: MCPJam inspector 1.4.3. Check the vendor advisory for mitigations.

References

• https://github.com/MCPJam/inspector/commit/e6b9cf9d9e6c9cbec31493b1bdca3a1255fe3e7a
• https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6

Get alerted when CVE-2026-23744 or the next vulnerability affects your stack