CVE-2026-102243

MODSetter SurfSense MCP Connector Integration test command injection

View on CVE.org
Published Sep 29, 2026 CVSS 4.0 · 5.3 Medium EPSS 1.2% KEV · Not listed
Description
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

A flaw in MODSetter SurfSense allows an attacker to inject arbitrary system commands through the /api/search-source/connectors/mcp/test endpoint. The vulnerability is categorized under command injection weaknesses: CWE-74 for improper input validation that leads to command concatenation and CWE-77 for unsanitized command execution. This flaw enables a remote attacker to send specially crafted requests that cause the server to execute arbitrary shell commands, potentially exposing full control over the host machine.

Affected Systems

MODSetter SurfSense versions up to and including 2.0.3 are affected. No information was provided about fixes in later releases, so any installation of 2.0.3 or earlier should be treated as vulnerable until a vendor update becomes available.

Risk and Exploitability

The CVSS score of 5.3 denotes a moderate severity, but the vulnerability can be leveraged remotely without authentication and there are publicly available proofs of concept. The EPSS score is 1%, and the issue is not listed in the CISA KEV catalog, yet the presence of a remote command injection and public exploit code elevates the operational risk to a high priority for exposed services.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade MODSetter SurfSense to a version newer than 2.0.3 when a vendor patch is released.
  • Limit access to the /api/search-source/connectors/mcp/test endpoint by requiring authentication and implementing fine‑grained authorization checks.
  • Validate and sanitize all input received by the MCP Connector Integration component to prevent shell metacharacter injection.
  • Configure network segmentation or firewall rules to restrict external reachability to the affected API endpoints.
  • Enable logging and monitoring to detect suspicious command execution attempts.

Generated by OpenCVE AI on September 30, 2026 at 04:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title MODSetter SurfSense MCP Connector Integration test command injection
First Time appeared Modsetter
Modsetter surfsense
Weaknesses CWE-74
CWE-77
CPEs cpe:2.3:a:modsetter:surfsense:*:*:*:*:*:*:*:*
Vendors & Products Modsetter
Modsetter surfsense
References
Metrics cvssV2_0

{'score': 6.5, 'vector': 'AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P'}
Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-77

    Improper Neutralization of Special Elements used in a Command ('Command Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 29, 2026, 10:42 AM
Reserved
Sep 28, 2026, 6:46 PM

View source JSON

Updated
Sep 29, 2026, 10:42 AM

JSON

Status
Deferred
Published
Sep 29, 2026, 3:17 AM
Modified
Sep 29, 2026, 6:57 PM

View source JSON

No data.

Updated
Sep 30, 2026, 4:45 AM

JSON