PT-2026-30837 · Unknown · Runzero Platform

Runzero · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-5374

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions runZero Platform versions prior to 4.0.260202.0

Description A flaw allowed MCP agents to access remediation and asset information outside of authorized organizational boundaries. This is categorized as incorrect authorization.

Recommendations Update to version 4.0.260202.0 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-5374

Affected Products

Runzero Platform

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-5374 · Security Note
• https://runzero.com/advisories/runzero-platform-mcp-infoleak-cve-2026-5374 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041711913030316420 · Twitter Post
• https://help.runzero.com/docs/release-notes/#402602020 · Note
• https://twitter.com/infoflowcloud/status/2041714253137133904 · Twitter Post