CVE-2026-5379

CVE-2026-5379 is an authorization bypass vulnerability affecting the runZero Platform that allowed Model Context Protocol (MCP) agents to access certificate information beyond their authorized organizational scope. The vulnerability represents an instance of improper access control (CWE-863) and has been patched in version 4.0.260203.0. This issue was limited to certificate information disclosure and did not enable modification or denial of service capabilities. The vulnerability carries a low severity rating with a CVSS score of 3.0, reflecting several mitigating factors including high attack complexity, high privilege requirements, and network accessibility. The attack vector requires an authenticated user with elevated privileges to exploit, and the impact is limited to low-level confidentiality compromise with no integrity or availability implications. The confined scope and restrictive prerequisites significantly limit the practical risk. There is currently no evidence of active exploitation, and the vulnerability is not tracked on the Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.00023 indicates this represents one of the least likely CVEs to be exploited in the wild. Community attention remains minimal, with no publicly available exploit code or widespread discussion, making this a low-priority threat for most organizations using runZero.