EUVD-2026-19696
GHSA-pqp2-x3gp-9g37
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N (3.0 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.
AnalysisAI
runZero Platform versions prior to 4.0.260203.0 allow authenticated high-privilege MCP agents to access certificate information outside their authorized organization scope, enabling lateral information disclosure across organizational boundaries. The vulnerability stems from improper authorization checks (CWE-863) and carries a CVSS score of 3.0 (Low) due to high attack complexity and privilege requirements; no public exploit code or active exploitation has been identified.
Technical ContextAI
The vulnerability exists in the Model Context Protocol (MCP) agent implementation within runZero Platform, a network intelligence and security platform (CPE: cpe:2.3:a:runzero:platform:*:*:*:*:*:*:*:*). MCP agents operate as trusted system components that should enforce organizational scope boundaries when accessing sensitive certificate metadata. The flaw represents a classic authorization bypass (CWE-863: Incorrect Authorization) where the platform fails to validate whether an MCP agent's organizational context permits access to requested certificate objects. This allows an authenticated agent with high-level privileges to enumerate or retrieve certificate information belonging to other organizations within the same multi-tenant deployment, violating the intended isolation model.
RemediationAI
Vendor-released patch: runZero Platform version 4.0.260203.0 or later. Organizations should upgrade immediately to the patched version via standard deployment channels. Pending upgrade, restrict administrative API access and MCP agent provisioning to trusted personnel; audit certificate access logs for unauthorized cross-organization queries. For detailed upgrade instructions and advisory context, consult https://www.runzero.com/advisories/runzero-platform-mcp-cert-infoleak-cve-2026-5379/ and the release notes at https://help.runzero.com/docs/release-notes/#402602030.
Server-side request forgery in Huly Platform's /import endpoint allows authenticated workspace users to coerce the front
Affected 1E Platform versions have a Blind SQL Injection vulnerability that can lead to arbitrary code execution. Rated
Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dash
Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.
The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. Rate
Improper privilege management in runZero Platform allows organization administrators to escalate privileges to superuser
Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensiti
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive i
The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exch
The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does n
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today