https://bokkapig.pages.dev/tags/token-leak/Recent content in Token Leak on bokkapigHugoen-gbSat, 30 May 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/devhub/Sat, 30 May 2026 00:00:00 +0000https://bokkapig.pages.dev/writeups/devhub/DevHub exposes an MCPJam Inspector v1.4.2 on 6274 bound to 0.0.0.0; its unauthenticated /api/mcp/connect endpoint passes serverConfig.command and serverConfig.args straight to the Node spawner (CVE-2026-23744, CVSS 9.8), giving a reverse shell as mcp-dev. A JupyterLab server on 127.0.0.1:8888 leaks its –ServerApp.token on the process command line, so tunnelling 8888 and pasting the token yields an IPython console running as analyst and the user flag. Root comes from an internal Flask ‘OPSMCP’ service on 127.0.0.1:5000 whose world-readable /opt/opsmcp/server.py hardcodes its X-API-Key and registers an undocumented ops._admin_dump tool that cats /root/.ssh/id_rsa — the returned key logs straight in as root.