CVE-2026-102243 | MODSetter SurfSense up to 2.0.3 MCP Connector Integration test command injection

September 28, 2026 Yanac

A vulnerability, which was classified as critical, was found in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection.

This vulnerability is referenced as CVE-2026-102243. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More