CVE-2026-5382

CVE-2026-5382 is an authorization bypass vulnerability in the runZero Platform that could allow authenticated users to access records outside their authorized organization scope through the MCP endpoints. The issue stems from improper access controls (CWE-863) and was remediated in platform version 4.0.260206.0. This vulnerability specifically affects the runZero Platform prior to the patched version. The vulnerability carries a CVSS score of 3.0 (Low severity) with a network attack vector requiring high privilege level access and high attack complexity. The impact is limited to low-level confidentiality compromise, with no integrity or availability impact. The attack requires an authenticated high-privileged user to exploit the flaw through network-based MCP endpoints. There is no evidence of active exploitation in the wild, as CVE-2026-5382 does not appear on the CISA Known Exploited Vulnerabilities (KEV) list and is currently inactive on vulnerability hot lists. The EPSS score of 0.00039 indicates minimal probability of exploitation relative to other CVEs. Organizations running runZero Platform should upgrade to version 4.0.260206.0 or later as a standard security practice, though immediate emergency action is not warranted given the low severity rating and lack of exploitation activity.