MCPJam Inspector RCE (CVE-2026-23744)
Date: 2026-01
Affected: MCPJam Inspector RCE (CVE-2026-23744)
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2026-23744
CWE: CWE-306
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVSS 9.8. MCPJam inspector v1.4.2 and earlier listens on 0.0.0.0 by default with no authentication. A crafted HTTP request installs a malicious MCP server and executes arbitrary code. Public exploit available. Fixed in v1.4.3.


Mitigations:

Architectural layers (MAESTRO):