What is the CVSS score of CVE-2026-5382?

CVE-2026-5382 has a CVSS 3.1 base score of 3.0 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5382?

Yes, a patch is available for CVE-2026-5382. Update the affected software to the latest version immediately.

Platform CVE-2026-5382

EUVD-2026-19699 LOW

Incorrect Authorization (CWE-863)

2026-04-07 runZero

GHSA-69vg-gq6x-ppc2

Authentication Bypass Platform Runzero

3.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.0 LOW

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

4.0.260206.0

EUVD ID Assigned

Apr 07, 2026 - 15:00 euvd

EUVD-2026-19699

Analysis Generated

Apr 07, 2026 - 15:00 vuln.today

CVE Published

Apr 07, 2026 - 14:12 nvd

LOW 3.0

DescriptionCVE.org

An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N (3.0 Low). This issue was fixed in version 4.0.260206.0 of the runZero Platform.

AnalysisAI

Incorrect authorization in runZero Platform MCP endpoints allows authenticated high-privilege users to access records outside their authorized organization scope, exposing sensitive data across organizational boundaries. The vulnerability affects runZero Platform versions prior to 4.0.260206.0 and requires high-privilege credentials to exploit, resulting in limited confidentiality impact. No public exploit code or active exploitation has been identified.

Technical ContextAI

The vulnerability is rooted in CWE-863 (Incorrect Authorization), a class of flaw where access control mechanisms fail to properly enforce organizational boundaries. The MCP (Management Control Plane) endpoints in runZero Platform lack sufficient authorization checks to validate that requesting users are restricted to their assigned organization scope. This allows privilege escalation within the application's authorization model, where high-privilege users can bypass organization isolation controls to query and retrieve records belonging to other organizations, even though no actual privilege elevation occurs at the user account level. The issue manifests through the platform's API/endpoint layer rather than in underlying authentication mechanisms.

RemediationAI

Organizations should immediately upgrade to runZero Platform version 4.0.260206.0 or later, which includes the fix for the MCP endpoint authorization controls. Until patching is completed, restrict high-privilege administrative access to only personnel requiring MCP endpoint interaction, and implement network segmentation to limit unauthorized administrative sessions if deployment architecture permits. Verify remediation by testing cross-organization record access attempts with high-privilege credentials. Consult the runZero release notes (https://help.runzero.com/docs/release-notes/#402602060) and advisory (https://www.runzero.com/advisories/runzero-platform-mcp-infoleak-cve-2026-5382/) for additional deployment guidance.