CVE-2026-5379: runZero Platform MCP certification information leak
An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N (3.0 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5379?
CVE-2026-5379 has an estimated CVSS score indicating a potential medium severity due to incorrect authorization issues.
How do I fix CVE-2026-5379?
To fix CVE-2026-5379, update the runZero Platform to version 4.0.260203.1 or later.
What type of vulnerability is CVE-2026-5379?
CVE-2026-5379 is classified as an Incorrect Authorization vulnerability, allowing unauthorized access to certificate information.
Which versions of runZero Platform are affected by CVE-2026-5379?
CVE-2026-5379 affects versions of the runZero Platform up to 4.0.260203.0.
What does CVE-2026-5379 allow attackers to do?
CVE-2026-5379 allows attackers to access certificate information from outside their authorized organization scope.