Live › vulnerability › CVE-2026-23744
Go to dashboardMCPJam Inspector, a development platform for MCP servers, has a memory corruption flaw triggered by malformed input payloads. Cloudflare reports that successful exploitation allows arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 19:12 UTC, 0h before NVD. All times on this page are UTC.
Teams running MCPJam Inspector below 1.4.3 are affected, and the sources say the flaw is reachable through malformed input payloads. The sources do not say whether localhost-only use is safe, so treat any shared or networked instance as exposed. Developers who only run the latest version can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| mcpjam inspector | vendor | < 1.4.3 | 1.4.3 |
1.4.3 is affected....d46229eb (MCP Server - Remote Code Execution - CVE:CVE-2026-23744) is in Block mode.1.4.3....d46229eb to Block (Cloudflare's WAF release of 2026-04-07 sets it to Block).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WAF Release - 2026-04-07 · Changelog
New updates and improvements at Cloudflare.
April 7, 2026
This week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging "OnEvent" handlers within HTTP cookies.
Key Findings
Impact
Successful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.
| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |
|---|---|---|---|---|---|---|
| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |
| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log |
This page as .md · .json · in your agent: get_signal("CVE-2026-23744")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
| Block |
| This is a new detection. |
| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |
| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |