CVE-2026-5374

An authorization bypass vulnerability in the runZero Platform MCP service allows bypassing authorization through a user-controlled key (CWE-639). The issue is fixed in version 5.1.260826.0, with an estimated CVSS score of 3.5 (Low).

An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This is an instance of CWE-269: Improper Privilege Management, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N (5.0, Medium). This issue was fixed in version v4.0.260416.0 of the runZero Platform.

An issue in the runZero Platform that could allow a credential to be updated and used for a task outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).

An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 3.0 (Low). The issue was fixed in version 4.0.260206.0 of the runZero Platform.

An issue that could expose task information outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 2.2 (Low). The issue was fixed in version 4.0.260205.0 of the runZero Platform.

An issue that could allow an authorized user to view clear-text secrets for a subset of credential types and fields has been resolved in the runZero Platform. This is an instance of CWE-522: Insufficiently Protected Credentials, with an estimated CVSS score of 5.3 (Medium). The issue was fixed in version 4.0.260204.2.

An issue allowing MCP agents to access certificate information outside their authorized organization scope has been resolved. It is CWE-863 Incorrect Authorization with an estimated CVSS of 3.0 (Low), fixed in runZero Platform version 4.0.260203.0.

An issue in runZero Platform that allowed administrators to create and update users outside their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium). The issue was fixed in version 4.0.260203.0.

An issue in the runZero Platform that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is CWE-613: Insufficient Control of Resources After Expiration or Release, with an estimated CVSS score of 5.9 (Medium).

An issue in the runZero Platform that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, with an estimated CVSS score of 2.7 (Low). The issue was fixed in version 4.0.260203.0.