AutoJack RCE - Base64 Server Params in URL

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Detects web requests attempting to exploit CWE-78 in AutoGen MCP via base64 encoded parameters in the URL. Specifically looks for '/api/mcp/ws/' and 'server_params=' within syslog messages.