runZero Platform CVE-2026-81846

Exploitation requires a valid authenticated account on the runZero Platform (CVSS PR:L). The attacker must target the MCP service specifically and must be able to identify or enumerate a user-controlled key value that resolves to another user's or organization's findings summaries. High attack complexity (AC:H) reflects the difficulty of obtaining valid cross-tenant keys. The impact is read-only and limited to findings summary data - no write or denial-of-service capability. There is no indication that default configurations are immune; any deployment with the MCP service active and multiple tenants or users is in scope.

The overall risk is low. The CVSS base score of 3.5 is consistent with the described impact: network-accessible (AV:N) but requiring a legitimately authenticated account (PR:L) and high attack complexity (AC:H), meaning the attacker must correctly enumerate or infer a valid user-controlled key belonging to another tenant. The scope change (S:C) elevates the theoretical severity by crossing authorization boundaries, but the actual impact is bounded to limited confidentiality (C:L) - findings summaries only - with no integrity or availability consequence. EPSS data is not provided; given the niche deployment footprint of runZero and the high attack complexity, opportunistic at-scale exploitation is unlikely. No KEV listing or public exploit code is present. This is a real but low-priority vulnerability: patching at next maintenance cycle is appropriate for most operators, and no emergency response is warranted.

An authenticated runZero Platform user crafts API requests to the MCP service, substituting a user-controlled key parameter with an identifier belonging to a different organization or user. If the key resolves successfully, the service returns that target's findings summary data without enforcing the requester's authorization boundary. No public exploit code is available; an attacker would need to enumerate or guess valid keys belonging to other tenants.