CVE-2026-102243: MODSetter SurfSense MCP Connector Integration test command injection
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The vulnerability is remotely exploitable and requires low privileges. No user interaction is required.
Which deployments should be considered exposed?
MODSetter SurfSense versions up to 2.0.3 should be considered potentially affected where the MCP Connector Integration test endpoint at /api/search-source/connectors/mcp/test is reachable by an attacker with the required privileges.
Is exploit activity a realistic concern?
Yes. A public exploit is available, and the exploitability metric is rated as proven.
What are the potential effects of successful exploitation?
Successful command injection can affect confidentiality, integrity, and availability, with impacts extending beyond the initially vulnerable component.