CVE-2026-23744

Name of the Vulnerable Software and Affected Versions MCPJam inspector versions prior to 1.4.3

Description MCPJam inspector is a local-first development platform for MCP servers. The software is susceptible to remote code execution (RCE) because it binds to 0.0.0.0 by default instead of 127.0.0.1, making its HTTP APIs remotely accessible. An attacker can send a crafted HTTP request to the '/api/mcp/connect' endpoint, which is intended for connecting to MCP servers. The system extracts the command and args variables from the request without performing security checks, allowing the execution of arbitrary commands on the target system.

Recommendations Update to version 1.4.3. Restrict access to the '/api/mcp/connect' endpoint to minimize the risk of exploitation.