## https://sploitus.com/exploit?id=FBD1D925-171D-5323-8F0D-E444A285FD37
# MCPJam Inspector Authorized Security Validator
A bounded proof-of-concept validator for **CVE-2026-23744** affecting vulnerable
MCPJam Inspector deployments.
This repository is intended for security professionals validating systems they
own or have explicit written authorization to assess.
## Safety Properties
- Requires an operator-supplied target and the `--authorized` acknowledgement.
- Executes only a fixed, non-destructive evidence command.
- Does not accept arbitrary operating-system commands.
- Does not establish a shell, access credentials, create persistence, or
attempt privilege escalation.
- Caps returned evidence and removes the temporary MCP session.
- Contains no customer, lab, credential, or target-specific data.
## Usage
```bash
python mcpjam_authorized_validator.py \
--target http://inspector.example.internal:6274 \
--authorized \
--output assessment-result.json
```
Exit codes:
- `0`: vulnerability was not validated
- `1`: vulnerability was validated
- `2`: invalid arguments or missing authorization acknowledgement
## Interpreting Results
A vulnerable result means the unauthenticated MCP connection endpoint launched
the validator's fixed process and returned its evidence. Treat this as remote
code execution under the MCPJam service account.
The validator intentionally stops after proving execution. Do not attempt
privilege escalation or access sensitive data unless separately authorized and
required by the rules of engagement.
## Remediation
1. Upgrade MCPJam Inspector to a release containing the vendor fix.
2. Remove public or untrusted-network access to the Inspector service.
3. Bind administrative tooling to a trusted management interface.
4. Require authentication and authorization before process-launch operations.
5. Review service-account permissions and rotate potentially exposed secrets.
6. Inspect logs for unexpected requests to `/api/mcp/connect`.
## Responsible Use
Use only against assets you own or have explicit permission to test. Users are
responsible for complying with applicable laws, contracts, and rules of
engagement.
## Reference
- CVE-2026-23744
- GHSA-232v-j27c-5pp6