CVE-2026-23744 REC in MCPJam inspector due to HTTP Endpoint exposes
An attacker can achieve remote code execution by sending a crafted HTTP request to the MCPJam inspector, which lacks authentication on its default network interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23744?
CVE-2026-23744 is a critical missing authorization vulnerability in MCPJam inspector, published on 16 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.
Weakness: CWE-306
Which versions are affected by CVE-2026-23744?
2 open source packages ship an affected version, including @mcpjam/inspector. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@mcpjam/inspector npm | All versions | 1.4.3 |
@mcpjam/inspector npm | All versions | 1.4.3 |
Products include Mcpjam Inspector.
How do I fix CVE-2026-23744?
Upgrade @mcpjam/inspector to 1.4.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-23744 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-23744 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 39 proofs of concept on GitHub.
Sources
Also known as GHSA-232v-j27c-5pp6.