CVE-2026-5381
LowCVSS 2.2Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 2.2 (Low). The issue was fixed in version 4.0.260205.0 of the runZero Platform.
Risk Assessment
Incorrect authorization may allow an authenticated user to view task information belonging to other organizations, violating data isolation. The confidentiality impact is low and the attack requires high privileges.
Recommendation
Update the runZero Platform to version 4.0.260205.0 or later. Check whether unauthorized access to task information occurred.
Other vulnerabilities in runZero Platform
See all- CVE-2026-81846Low
An authorization bypass vulnerability in the runZero Platform MCP service allows bypassing authorization through a user-controlled key (CWE-639). The issue is fixed in version 5.1.260826.0, with an estimated CVSS score of 3.5 (Low).
- CVE-2026-7778Medium
An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.
- CVE-2026-5384Medium
An issue in the runZero Platform that could allow a credential to be updated and used for a task outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).
- CVE-2026-5382Low
An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 3.0 (Low). The issue was fixed in version 4.0.260206.0 of the runZero Platform.
- CVE-2026-5380Medium
An issue that could allow an authorized user to view clear-text secrets for a subset of credential types and fields has been resolved in the runZero Platform. This is an instance of CWE-522: Insufficiently Protected Credentials, with an estimated CVSS score of 5.3 (Medium). The issue was fixed in version 4.0.260204.2.
- CVE-2026-5379Low
An issue allowing MCP agents to access certificate information outside their authorized organization scope has been resolved. It is CWE-863 Incorrect Authorization with an estimated CVSS of 3.0 (Low), fixed in runZero Platform version 4.0.260203.0.
- CVE-2026-5378Medium
An issue in runZero Platform that allowed administrators to create and update users outside their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium). The issue was fixed in version 4.0.260203.0.
- CVE-2026-5376Medium
An issue in the runZero Platform that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is CWE-613: Insufficient Control of Resources After Expiration or Release, with an estimated CVSS score of 5.9 (Medium).
- CVE-2026-5375Low
An issue in the runZero Platform that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with an estimated CVSS score of 2.7 (Low). The issue was fixed in version 4.0.260203.0.
- CVE-2026-5374Medium
An issue in the runZero Platform that allowed MCP agents to access remediation and asset information outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).
Original NVD description (English source)
An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N (2.2 Low). This issue was fixed in version 4.0.260205.0 of the runZero Platform.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS