What is the CVSS score of CVE-2026-5375?

CVE-2026-5375 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5375?

Yes, a patch is available for CVE-2026-5375. Update the affected software to the latest version immediately.

Platform CVE-2026-5375

EUVD-2026-19636 LOW

Information Exposure (CWE-200)

2026-04-07 runZero

GHSA-5fhv-ppcw-vh7h

Information Disclosure Platform Runzero

2.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260203.0

EUVD ID Assigned

Apr 07, 2026 - 14:30 euvd

EUVD-2026-19636

Analysis Generated

Apr 07, 2026 - 14:30 vuln.today

CVE Published

Apr 07, 2026 - 14:11 nvd

LOW 2.7

DescriptionCVE.org

An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

AnalysisAI

runZero Platform API exposes sensitive credential fields to high-privilege users via unauthenticated remote requests, allowing information disclosure of confidential data. Affected versions prior to 4.0.260203.0 permit high-privilege account holders to retrieve sensitive fields through API responses that should be restricted. The vulnerability requires high privileges (PR:H) and has low real-world impact (CVSS 2.7), but affects the core credential management functionality of the runZero asset intelligence platform.

Technical ContextAI

The vulnerability is rooted in CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a common API design flaw where sensitive data fields are inadvertently included in API responses without proper access controls or filtering. In this case, the runZero Platform's API response serialization logic fails to redact or suppress sensitive credential attributes when returning data to clients, even though those fields should be protected. The issue manifests in the platform's credential management subsystem, where API endpoints handling credential queries do not properly enforce field-level access controls. The affected CPE (cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*) indicates all versions of the runZero Platform prior to the patch are vulnerable, though the high-privilege requirement (PR:H in CVSS vector) means the threat actor must already possess administrative or equivalent credentials.

RemediationAI

Vendor-released patch: runZero Platform 4.0.260203.0 and later. Users should immediately upgrade to version 4.0.260203.0 or the latest available release to remediate the credential information exposure. See the official runZero advisory at https://www.runzero.com/advisories/runzero-platform-api-cred-infoleak-cve-2026-5375/ and release notes at https://help.runzero.com/docs/release-notes/#402602030 for detailed upgrade instructions and verification steps. If immediate patching is delayed, restrict API access to trusted networks and audit high-privilege account activity for unauthorized credential enumeration.