Skip to main content
IMMUNITYSEC

CVE-2026-23744

REC in MCPJam inspector due to HTTP Endpoint exposes

9.8
CRITICAL
CVSS 3.1
EPSS 67.5% · 99th pctCWE-306
2026-01-16

Description

MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.

Severity

CVSS 3.1 · CNA9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationpoc
Automatableyes
Technical impacttotal

Exploitation Context

as of October 14, 2026
All KEV statistics→
  • Its current EPSS score (67.5%) is higher than that of 56% of CISA KEV entries.

Affected Products

ProductAffected versions
MCPJam
inspector
<= 1.4.2

References

2 Links

Record Details

Published
2026-01-16
Last updated
2026-01-16
Assigner (CNA)
GitHub_M
Credited to
-

Related

Tool categories

IAM ToolsApplication Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.