HTB DevHub Complete Writeup - CVE-2026-23744 MCPJam RCE, JupyterLab WebSocket Code Execution & OPSMCP Admin Tool Abuse

A comprehensive penetration testing guide exploiting CVE-2026-23744 for initial foothold via unauthenticated MCPJam Inspector RCE, pivoting through a token-leaking JupyterLab instance for code execution as analyst, reading hardcoded credentials from OPSMCP Flask source, and abusing a hidden admin tool running as root to dump an SSH private key and gain full root access.

May 31, 2026 • views • 13 min read • 1,400 words

By

Havoc

hackthebox 26 htb 30 linux 11 cve-2026-23744 2 mcpjam 2 mcp 2 jupyterlab jupyter flask rce 8 websocket token-exposure process-args hardcoded-credentials hidden-endpoint privilege-escalation 17 ssh-key-exfiltration medium-difficulty 7 season11 3