EUVD-2026-19635
GHSA-9359-vm49-5gpx
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.260202.0 of the runZero Platform.
AnalysisAI
Runzero Platform versions prior to 4.0.260202.0 allow authenticated administrators with high privileges to access remediation and asset information across organizational boundaries through MCP agents, exposing sensitive data from unauthorized organization scopes. The vulnerability stems from improper authorization controls (CWE-863) and requires high-privilege account compromise to exploit, carrying a CVSS score of 5.8 (Medium). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Vulnerability AssessmentAI
| Risk Assessment | This vulnerability presents a moderate real-world risk despite its 5.8 CVSS score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A threat actor compromises a Runzero Platform administrative account through credential theft or phishing, then leverages the high-privilege credentials to configure or manipulate MCP agents to query remediation and asset information from organizations other than the one the account legitimately administers. Due to the improper authorization controls, the MCP agent returns sensitive cross-organizational data without enforcing scope boundaries. … |
| Remediation | Upgrade Runzero Platform immediately to version 4.0.260202.0 or later, which includes the authorization fix for MCP agent scope validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today