Platform CVE-2026-5380

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates remote network access with high attack complexity, no privileges required, but user interaction needed, resulting in a 5.3 Medium score with high confidentiality impact. However, the PR:N designation is misleading here-the description explicitly states 'authorized user', meaning authentication is a practical prerequisite despite the vector showing PR:N. The high attack complexity (AC:H) and required user interaction (UI:R) further reduce real-world likelihood. The lack of KEV status (not actively exploited) and absence of public exploit code suggest this is a lower priority than the CVSS alone indicates. This is a legitimate credential exposure risk for organizations running vulnerable versions, but exploitation requires an insider threat model or compromised account rather than external attack. Organizations should prioritize patching based on sensitive credential types stored in their runZero instances and the trustworthiness of their user base.

An insider with valid runZero Platform credentials (e.g., a junior security analyst or contractor with basic platform access) navigates to a credential management interface and, due to insufficient authorization checks, is able to view and extract cleartext secrets for credential types the application failed to properly protect. The attacker then uses these exposed credentials to compromise connected systems or services. No public exploit code is known, and this scenario relies on the attacker having legitimate platform access rather than external network compromise.