Authorization Flaw in RunZero Platform Affects MCP Agents
CVE-2026-5379

3LOW

Key Information:

Vendor

Runzero

Status
Platform
Vendor
CVE Published:
7 April 2026

What is CVE-2026-5379?

An authorization flaw has been identified in the RunZero Platform affecting MCP agents, allowing them to access certificate information beyond their authorized organizational scope. This issue reflects CWE-863, which relates to improper authorization checks. The vulnerability was effectively addressed in version 4.0.260203.0, enhancing the platform's security posture.

Affected Version(s)

Platform 0 < 4.0.260203.0

References

https://help.runzero.com/docs/release-notes/#402602030
release-notes
https://www.runzero.com/advisories/runzero-platform-mcp-c...
vendor-advisory

CVSS V3.1

Score:
3
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

runZero
.