VulnerabilityAnalyzed

CVE-2026-5379

An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved.

LOW 3.0EPSS 0.12%

Does this matter?

Lower severity and a low EPSS score (0.12%). Track it; it rarely justifies an emergency change on its own.

Description

An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N (3.0 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

CVSS 3.1: 3.0 LOWCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.12% probability · 2th percentile
CISA KEV: Not listed
Weakness: CWE-863
Affected: runzero/runzero platform
Source: 44488dab-36db-4358-99f9-bc116477f914

References

https://help.runzero.com/docs/release-notes/#402602030Release Notes
https://www.runzero.com/advisories/runzero-platform-mcp-cert-infoleak-cve-2026-5379/Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.