8 matches found
CVE-2026-23744
CVE-2026-23744 CVE-2026-23744 RCE 在分析此漏洞时，我发现 MCPJam Inspector 将 /api/mcp/connect 端点绑定到 0.0.0.0，从而暴露在网络中。该端点接受一个包含 serverConfig 的 JSON 对象，其中包含 command 和 args 字段。 该应用旨在启动 MCP 服务器，但未能正确处理用户提供的值。因此，攻击者可以发送包含任意命令和参数的构造 HTTP 请求，这些请求随后会在服务器上执行，导致远程代码执行 RCE。 最有趣的是，漏洞利用载荷并非任意构造。通过使用 Burp Suite...
PoC-CVE-2026-23744
PoC-CVE-2026-23744 Esecuzione di codice remoto su MCPJam Inspector Riferimento https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...
DevHub-HTB-Walkthrough
DevHub – HTB Walkthrough Medium Linux Macchina: DevHub Difficoltà: Medium OS: Linux Argomenti: CVE-2026-23744, Tunneling con Chisel, Jupyter, Flask API, Escalation dei privilegi di root 📌 1. Ricognizione root@kitploit: nmap -sC -sV devhub.htb Risultato: root@kitploit: Porta 22 SSH Porta 80 HTTP...
CVE-2026-23744-MCPJAM-RCE-exploit
CVE-2026-23744-MCPJAM-RCE-exploit Questo proof-of-concept in Python prende di mira un servizio MCP Model Context Protocol vulnerabile esposto dall'applicazione target. La vulnerabilità consente a un attaccante di fornire parametri arbitrari di configurazione del server attraverso l'endpoint...
GO-2026-5678 Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot
Obot has an authorization bypass in /mcp-connect/id that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 — MCPJam Unauthenticated Remote Code Execution...
GHSA-VW82-7FV8-R6GP Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server
Summary If you have the MCP Server ID, you can connect to the MCP server even if you don't have permissions to the server. The MCP gateway endpoint /mcp-connect/mcpid does not enforce Access Control Rules ACRs. Any authenticated Obot user who possesses an MCP Server ID can connect to that server...