Platform EUVD-2026-19696

Risk is contextual and depends on deployment model. CVSS 3.0 reflects the protective factors: network-reachable but high attack complexity (AC:H), high privilege requirement (PR:H), and limited scope-only confidentiality of certificate metadata is affected (C:L; no integrity or availability impact). However, CVSS underweights the business risk in multi-tenant environments where organizational isolation is a security boundary; an attacker with administrative credentials could conduct competitive intelligence or reconnaissance against other organizations' PKI infrastructure. EPSS data is not provided, limiting probabilistic exploitation assessment. The lack of a KEV entry or public POC suggests this was likely discovered during internal security review or a limited third-party assessment rather than opportunistic exploitation. Given the requirement for PR:H (high privilege) and AC:H conditions, real-world exploitability is low outside of insider threat scenarios or compromised admin accounts. The tagging as 'Authentication Bypass' is somewhat misleading-this is an authorization (not authentication) flaw requiring valid credentials to trigger.

An authenticated administrator or high-privilege MCP agent provisioned by an organization could send certificate queries to the runZero Platform API to retrieve certificate metadata belonging to other organizations in a multi-tenant instance, exposing public key details, issuer names, expiration dates, and subject information. No technical barrier (only organizational policy) would prevent this reconnaissance, allowing an attacker to build an inventory of competitors' or targets' PKI infrastructure. Such access might enable downstream attacks on certificate pinning mechanisms or supply-chain reconnaissance, though active exploitation would require existing administrative credentials and knowledge of other organizations' certificate identifiers.