CVE-2026-102243

HIGH 7.4

MODSetter SurfSense MCP Connector Integration test command injection

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-77 CWE-74
Vendor	modsetter
Product	surfsense
Published	Sep 29, 2026

Stay Ahead of the Next One

Get instant alerts for modsetter surfsense

Be the first to know when new high vulnerabilities affecting modsetter surfsense are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

MODSetter / SurfSense

2.0.0 2.0.1 2.0.2 2.0.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/411141 vuldb.com: https://vuldb.com/vuln/411141/cti vuldb.com: https://vuldb.com/cve/CVE-2026-102243 vuldb.com: https://vuldb.com/submit/933323 gist.github.com: https://gist.github.com/DReazer/81504d373f4e32206dc885d3c415e278

Credits

🔍 Snkn0w (VulDB User) VulDB CNA Team