MCPJam Inspector RCE (CVE-2026-23744)

What it is

CVE-2026-23744 is an unauthenticated network RCE in the MCPJam inspector, a debugging/testing tool for MCP servers, affecting versions ≤1.4.2. Disclosed February 2026 via a GitLab security advisory, CVSS 9.8, fixed in v1.4.3.

What to do

The summary tells you to update to v1.4.3. The page adds concrete interim mitigations for when you can't patch immediately, plus a defense-in-depth stance worth keeping even after patching:

• Bind the inspector to 127.0.0.1 instead of 0.0.0.0, so the endpoint is not reachable off the host.
• Firewall the development-tool ports to restrict network access.
• Do not run the inspector (or other dev tools with network exposure) on untrusted networks at all.

The last point is the operational takeaway the summary omits: the realistic attack surface is shared networks — offices, coffee shops, co-working spaces — where any nearby machine can reach a default-bound inspector and land code execution with no interaction. That framing, not just "network-adjacent," is what tells an engineer whether their own usage is exposed today.

Caveats

The page states the fix both restricts the bind address and adds endpoint authentication; the 127.0.0.1 bind workaround only addresses the exposure, not the missing auth, so anything with local access (other users, containers sharing the host network) remains unauthenticated. Firewalling ports is a perimeter control, not a substitute for the patch.