runZero Platform MCP 'Findings summaries' Data Leak

|
Updated
Vendors runZero
Products
runZero Platform
  • runZero Platform
Related

Executive summary #

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).

Attacker value #

An authenticated attacker who knew the UUID of a target organization could exploit this vulnerability to retrieve Findings summaries belonging to that organization, potentially revealing summary information about security issues outside of the attacker's authorized scope. No modification of data or service disruption was possible through the affected behavior.

Credit #

This issue was discovered at runZero during a routine code security review.

Timeline #


2026-08-27 : Issue identified and fixed by the vendor

2026-09-01 : Published this advisory and CVE-2026-81846

Written by todb

Tod Beardsley is VP of Security Research at runZero, where he "kicks assets and fakes frames." Prior to 2025, he was the Section Chief for the Vulnerability Response section for CSD/VM/VRC at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government, and a seasonal Travis County Election Judge in Texas. He's also a founder and CNA point of contact for AHA!. Tod spends much of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern ICS/OT implementations. He has held IT ops, security, software engineering, and management positions in large organizations such as the US Government, Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Tod is a CVE Board member, has authored several research papers, and is an internationally-tolerated horror fiction expert.

More about todb
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.