Insufficiently Protected Credentials Vulnerability in RunZero Platform
CVE-2026-5380

5.3MEDIUM

Key Information:

Vendor

Runzero

Status
Platform
Vendor
CVE Published:
7 April 2026

What is CVE-2026-5380?

An authorized user could potentially access clear-text secrets for certain credential types and fields in the RunZero Platform, leading to unauthorized information exposure. This vulnerability stems from insufficient protections around credential storage, marking it as a critical issue for maintaining data confidentiality. The problem has been addressed in version 4.0.260204.2 of the RunZero Platform.

Affected Version(s)

Platform 0 < 4.0.260204.2

References

https://help.runzero.com/docs/release-notes/#402602042
release-notes
https://www.runzero.com/advisories/runzero-platform-clear...
vendor-advisory

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

runZero
.