CVE Alert: CVE-2026-102243 – MODSetter

A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/ -source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early this disclosure but did not respond in any way.

**Risk verdict:** Treat as a high-priority exposure for internet-reachable deployments: exploitation is reportedly feasible and a public exploit exists, but KEV, SSVC and EPSS status are not provided.

**Why this matters:** A successful attack could let an authenticated user execute commands in the application’s runtime, potentially exposing data or disrupting service. The attacker may also use the compromised process as a foothold to reach connected systems, depending on its permissions and network access.

**Most likely attack path:** A remote attacker with a low-privilege account submits crafted input to the connector’s test function; low complexity and no user interaction make this a practical path. The reported changed scope suggests impact could extend beyond the application’s immediate security authority, although the actual lateral-movement potential depends on runtime privileges and network segmentation.

**Who is most exposed:** Prioritise internet-facing deployments with MCP connectors enabled, especially shared instances and environments where the service can access sensitive data or internal networks.

Review web and application logs for unusual requests to connector test functionality and suspicious input.

Alert on the application process spawning shells or unexpected utilities.

Check process, container and host telemetry for outbound connections initiated by the service.

Inspect connector configuration changes and unexpected test activity by low-privilege accounts.

Mitigation and prioritisation:

Confirm vendor remediation; apply a verified fix promptly once available.

Until then, disable the affected connector test function or restrict access to trusted administrators.

Limit service-account permissions and outbound network access; segment the application from sensitive systems.

Test compensating controls in staging and use change management for production rollout.

Obtain KEV, SSVC and EPSS status to refine urgency; these indicators are absent here.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.