VulnerabilityDeferred

CVE-2026-81846

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0.

LOW 3.5EPSS 0.21%

Does this matter?

Lower severity and a low EPSS score (0.21%). Track it; it rarely justifies an emergency change on its own.

Description

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-639
Source: 44488dab-36db-4358-99f9-bc116477f914

References

https://help.runzero.com/docs/release-notes/#512608260
https://www.runzero.com/advisories/runzero-mcp-findings-summaries-data-leak-cve-2026-81846

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.