{"id":"CVE-2026-23744","kind":"vulnerability","aliases":["CVE-2026-23744"],"related":[],"title":"MCPJam Inspector: malformed input can run code on MCP testing tool","description":"WAF Release - 2026-04-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 7, 2026\n\n## WAF Release - 2026-04-07\n\nThis week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging \"OnEvent\" handlers within HTTP cookies.\n\nKey Findings\n\n- MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.\n- SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.\n- XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.\n\nImpact\n\nSuccessful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |","summary":"MCPJam Inspector, a development platform for MCP servers, has a memory corruption flaw triggered by malformed input payloads. Cloudflare reports that successful exploitation allows arbitrary code execution.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcpjam inspector","fixed":["1.4.3"],"affected":"< 1.4.3","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ai-tooling","cloudflare","developers","lab-disclosure","mcp","mcpjam-inspector","self-hosted"],"not_affected_if":["fixed-version-1.4.3-or-later"],"how_to_check":"- Check the installed MCPJam Inspector version; anything below `1.4.3` is affected.\n- Check whether the Inspector is reachable from networks beyond the developer's own machine; the sources do not say which deployment modes are exposed.\n- If the Inspector sits behind Cloudflare, confirm managed rule `...d46229eb` (MCP Server - Remote Code Execution - CVE:CVE-2026-23744) is in Block mode.","fix":"- Upgrade MCPJam Inspector to `1.4.3`.\n- Until upgraded, if it sits behind Cloudflare, set the managed rule `...d46229eb` to Block (Cloudflare's WAF release of 2026-04-07 sets it to Block).\n- Restrict network access to the Inspector to trusted hosts.","status":"open","published_at":"2026-01-16T20:15:51+00:00","first_seen_at":"2026-10-24T19:12:57+00:00","triaged_at":"2026-10-25T05:28:07+00:00","updated_at":"2026-10-25T05:28:07+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T05:28:07Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade MCPJam Inspector to `1.4.3`.\n- Until upgraded, if it sits behind Cloudflare, set the managed rule `...d46229eb` to Block (Cloudflare's WAF release of 2026-04-07 sets it to Block).\n- Restrict network access to the Inspector to trusted hosts.","reach":"unknown","title":"MCPJam Inspector: malformed input can run code on MCP testing tool","impact":"high","summary":"MCPJam Inspector, a development platform for MCP servers, has a memory corruption flaw triggered by malformed input payloads. Cloudflare reports that successful exploitation allows arbitrary code execution.","category":"ai-tooling","nicknames":[],"who_cares":["mcp","mcpjam-inspector","self-hosted","developers"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the machine hosting the Inspector","analyst_note":"Confirm the reach and auth requirements and the exposed deployment modes from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-23744) and the MCPJam advisory; the Cloudflare changelog only describes a generic MCP Server flaw.","how_to_check":"- Check the installed MCPJam Inspector version; anything below `1.4.3` is affected.\n- Check whether the Inspector is reachable from networks beyond the developer's own machine; the sources do not say which deployment modes are exposed.\n- If the Inspector sits behind Cloudflare, confirm managed rule `...d46229eb` (MCP Server - Remote Code Execution - CVE:CVE-2026-23744) is in Block mode.","needs_analyst":true,"not_affected_if":["fixed-version-1.4.3-or-later"],"who_is_affected":"Teams running MCPJam Inspector below 1.4.3 are affected, and the sources say the flaw is reachable through malformed input payloads. The sources do not say whether localhost-only use is safe, so treat any shared or networked instance as exposed. Developers who only run the latest version can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.001294,"input_tokens":4758,"output_tokens":1637,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-04':65C,81C '-07':66C,82C '-2025':116C,179C,503C '-2026':13A,16A,102C,150C,358C '-23744':14A,17A,103C,151C,359C '-40552':117C,180C,504C '0aa410af':295C '2':468C,484C '2026':64C,77C,80C '3':435C,452C '3e8143':430C '40732d48':400C '4c538bd9':464C '5':301C,319C,337C '551eb9e5':331C '61c439c9':480C '7':76C '70e7':447C '9131ec2f':313C '9712a863':385C 'a864b9c2':370C 'access':198C 'action':288C,290C 'addit':118C,257C 'administr':249C 'ai':21B 'ai-tool':20B 'allow':58B,172C,188C,240C 'alongsid':104C 'april':75C 'arbitrari':59B,174C,245C 'attack':190C,242C,264C 'attempt':138C 'auth':499C 'authent':109C,186C 'block':131C,340C,361C,376C,506C 'bodi':302C,389C,436C,469C 'browser':267C 'bypass':110C,192C,500C 'cf33ea10':496C 'changelog':67C,68C 'cloudflar':23B,53B,74C,292C,310C,328C,346C,367C,382C,397C,412C,427C,444C,461C,477C,493C 'code':7A,60B,94C,175C,246C,354C 'command':299C,317C,335C 'comment':291C 'consol':202C 'context':157C 'control':250C 'cooki':144C,211C,227C,271C,374C 'corrupt':46B,170C 'could':239C 'critic':92C,182C 'cross':133C 'cross-sit':132C 'cve':12A,15A,101C,115C,149C,178C,356C,357C,501C,502C 'd2':431C 'd46229eb':349C 'descript':286C 'design':127C 'detect':89C,125C,262C,309C,327C,345C,366C,381C,396C,411C,426C,443C,460C,476C,492C,511C 'develop':24B,38B 'disabl':304C,322C,391C,406C,421C,438C,455C,471C,487C 'disclosur':27B 'due':203C 'e68a99b5':415C 'embed':224C 'evas':388C,403C,418C 'event':217C,268C 'execut':61B,95C,176C,244C,277C,300C,318C,336C,355C 'exploit':57B,231C 'fb97':448C 'filter':194C 'find':146C 'flaw':47B,183C 'full':254C 'gain':196C,248C 'generic':124C,213C,260C,297C,315C,333C 'handler':141C,218C,269C 'header':320C,404C 'hijack':273C 'host':34B 'http':143C,226C 'id':282C,285C 'ident':206C 'identifi':129C,215C 'impact':229C 'implement':161C 'improp':205C 'improv':72C 'includ':121C 'inject':137C 'input':4A,51B,164C 'inspector':2A,19A,31B,36B 'introduc':87C 'key':145C 'lab':26B 'lab-disclosur':25B 'lead':251C 'legaci':283C 'leverag':139C,266C 'like':434C,451C 'log':303C,321C,339C,360C,375C,390C,405C,420C,437C,454C,470C,486C,505C 'malform':3A,50B,163C 'malici':216C,278C 'manag':201C,293C,311C,329C,347C,368C,383C,398C,413C,428C,445C,462C,478C,494C 'mcp':9A,28B,41B,99C,147C,159C,234C,351C 'mcpjam':1A,18A,30B,35B 'mcpjam-inspector':29B 'memori':45B,169C 'model':156C 'modul':187C 'n/a':296C,314C,332C,350C,371C,386C,401C,416C,432C,449C,465C,481C,497C 'new':69C,88C,123C,259C,289C,308C,326C,344C,365C,380C,395C,410C,425C,442C,459C,475C,491C,510C 'onerror':223C 'onev':140C,210C,373C 'onload':221C 'payload':52B,165C 'platform':39B 'prevent':263C 'previous':287C 'product':114C 'protect':106C 'protocol':158C 'rce':96C 'releas':63C,79C,86C,120C 'remot':93C,353C 'report':54B 'rule':126C,214C,281C,284C,298C,316C,334C 'ruleset':280C,294C,312C,330C,348C,369C,384C,399C,414C,429C,446C,463C,479C,495C 'run':6A 'script':135C,279C 'secur':193C 'self':33B 'self-host':32B 'server':42B,100C,148C,160C,235C,352C 'session':275C 'site':134C 'solarwind':113C,177C,237C,498C 'sqli':387C,402C,417C,433C,450C,466C,482C 'state':171C 'success':56B,230C 'system':255C 'takeov':256C 'target':105C 'test':10A 'token':207C 'tool':11A,22B 'trigger':48B,167C 'unauthent':189C,241C 'unauthor':197C 'union':467C,483C 'updat':70C 'uri':338C,419C,453C,485C 'user':274C 'valid':208C 'valu':228C 'vulner':97C,111C,153C,238C 'waf':62C,78C 'week':84C 'within':142C,225C 'xss':136C,209C,261C,372C","nicknames":[],"mitigations":[],"who_affected":"Teams running MCPJam Inspector below 1.4.3 are affected, and the sources say the flaw is reachable through malformed input payloads. The sources do not say whether localhost-only use is safe, so treat any shared or networked instance as exposed. Developers who only run the latest version can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-01-16T20:15:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"lab","external_id":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/#CVE-2026-23744","url":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/","severity":null,"published_at":"2026-04-07T19:12:03+00:00","modified_at":null,"first_seen_at":"2026-10-24T19:12:57+00:00","fetched_at":"2026-10-24T19:12:57+00:00","note":"Cloudflare: WAF Release - 2026-04-07 · Changelog"},{"source":"nvd","external_id":"CVE-2026-23744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23744","severity":null,"published_at":"2026-01-16T20:15:51+00:00","modified_at":"2026-06-17T10:22:02+00:00","first_seen_at":"2026-10-24T19:23:38+00:00","fetched_at":"2026-10-24T19:23:38+00:00","note":null}],"documents":[{"id":2922,"url":"https://developers.cloudflare.com/changelog/post/2026-04-07-waf-release/","title":"Cloudflare: WAF Release - 2026-04-07 · Changelog","kind":"advisory","source":"lab","text":"WAF Release - 2026-04-07 · Changelog\n\n# Changelog\n\nNew updates and improvements at Cloudflare.\n\nApril 7, 2026\n\n## WAF Release - 2026-04-07\n\nThis week's release introduces new detections for a critical Remote Code Execution (RCE) vulnerability in MCP Server (CVE-2026-23744), alongside targeted protection for an authentication bypass vulnerability in SolarWinds products (CVE-2025-40552). Additionally, this release includes a new generic detection rule designed to identify and block Cross-Site Scripting (XSS) injection attempts leveraging \"OnEvent\" handlers within HTTP cookies.\n\nKey Findings\n\n- MCP Server (CVE-2026-23744): A vulnerability in the Model Context Protocol (MCP) server implementation where malformed input payloads can trigger a memory corruption state, allowing for arbitrary code execution.\n- SolarWinds (CVE-2025-40552): A critical flaw in the authentication module allows unauthenticated attackers to bypass security filters and gain unauthorized access to the management console due to improper identity token validation.\n- XSS OnEvents Cookies: This generic rule identifies malicious event handlers (such as onload or onerror) embedded within HTTP cookie values.\n\nImpact\n\nSuccessful exploitation of the MCP Server and SolarWinds vulnerabilities could allow unauthenticated attackers to execute arbitrary code or gain administrative control, leading to a full system takeover. Additionally, the new generic XSS detection prevents attackers from leveraging browser event handlers in cookies to hijack user sessions or execute malicious scripts.\n\n| Ruleset | Rule ID | Legacy Rule ID | Description | Previous Action | New Action | Comments |\n| --- | --- | --- | --- | --- | --- | --- |\n| Cloudflare Managed Ruleset | ...0aa410af | N/A | Generic Rules - Command Execution - 5 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9131ec2f | N/A | Generic Rules - Command Execution - 5 - Header | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...551eb9e5 | N/A | Generic Rules - Command Execution - 5 - URI | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...d46229eb | N/A | MCP Server - Remote Code Execution - CVE:CVE-2026-23744 | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...a864b9c2 | N/A | XSS - OnEvents - Cookies | Log | Block | This is a new detection. |\n| Cloudflare Managed Ruleset | ...9712a863 | N/A | SQLi - Evasion - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...40732d48 | N/A | SQLi - Evasion - Headers | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...e68a99b5 | N/A | SQLi - Evasion - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...3e8143d2 | N/A | SQLi - LIKE 3 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...70e7fb97 | N/A | SQLi - LIKE 3 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...4c538bd9 | N/A | SQLi - UNION - 2 - Body | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...61c439c9 | N/A | SQLi - UNION - 2 - URI | Log | Disabled | This is a new detection. |\n| Cloudflare Managed Ruleset | ...cf33ea10 | N/A | SolarWinds - Auth Bypass - CVE:CVE-2025-40552 | Log | Block | This is a new detection. |","published_at":"2026-04-07T19:12:03+00:00","relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}