How severe is CVE-2026-23744?

CVE-2026-23744 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 67.5% probability of exploitation in the next 30 days.

CVE-2026-23744: REC in MCPJam inspector due to HTTP Endpoint

Description

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

Severity

CVSS 3.1 · CNA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationpoc

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
MCPJam	inspector	<= 1.4.2

References

2 Links

Other references

Record Details

Published

2026-01-16

Last updated

2026-01-16

Assigner (CNA)

GitHub_M

Credited to

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-306 · Missing Authentication for Critical Function

IAM Tools Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.