VDB
CVE-2026-23744
CVE-2026-23744
PUBLISHED
KEV
CVSS 9.800000190734863 CRITICAL
MCPJam inspector is the local-first development platform for MCP servers. Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. Since MCPJam inspector by default listens on 0.0.0.0 instead of 127.0.0.1, an attacker can trigger the RCE remotely via a simple HTTP request. Version 1.4.3 contains a patch.
EPSS 67.52% · 99.3th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
67.52%
99.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| mcpjam | inspector | 0, 0 |
| mcpjam | inspector | 0, 0 |
| MCPJam | inspector | <= 1.4.2, <= 1.4.2 |
Timeline
- Jun 23, 2022 CrowdSec Sighting
- Sep 24, 2022 CrowdSec Sighting
- Mar 3, 2023 CrowdSec Sighting
- Mar 9, 2023 CrowdSec Sighting
- May 14, 2023 CrowdSec Sighting
- Nov 12, 2023 CrowdSec Sighting
- Apr 12, 2024 CrowdSec Sighting
- May 10, 2024 CrowdSec Sighting
- May 30, 2024 CrowdSec Sighting
- May 31, 2024 CrowdSec Sighting
- Jun 1, 2024 CrowdSec Sighting
- Jul 9, 2024 CrowdSec Sighting