H3-2026-1081¶
MCPJam Inspector Session Token Leak via X-Forwarded-Host Bypass
| Category | VULNERABILITY |
| Base Score | 9.7 |
Description¶
MCPJam Inspector's isTunnelHost() function fails to properly parse comma separated X-Forwarded-Host header values. Remote attackers can inject a legitimate tunnel domain followed by an attacker controlled domain within a single X-Forwarded-Host header, causing the tunnel validation check to pass incorrectly. Once this check is bypassed, the application embeds the local session token directly into the returned HTML response. The flaw affects any Inspector instance reachable through a tunnel relay and requires no prior interaction from the victim.
Impact¶
Remote attackers who capture the leaked session token gain full access to the Inspector's protected API surface. This includes executing tools, managing configured MCP servers, and issuing arbitrary commands as the local user running Inspector. The access persists for as long as the session token remains valid. Any user reaching Inspector through a tunnel relay is exposed to this risk.