🤖 April 15 – Live, Laugh, Malware: LLMs in Cybersecurity! Register Now

Start Free Book Demo

Platform
- Exposure Management Platform
  Complete security visibility across IT, OT, IoT, cloud, mobile, and remote assets.
  
  Total Attack Surface Visibility
  
  Full-Spectrum Exposure Detection
  
  Risk Prioritization & Insights
  
  Compliance, Reporting, & KPIs
  
  Fast Deployment & Scalability
- Integrations
  runZero seamlessly integrates with a wide variety of tools, enhancing network visibility, enriching asset data, and uncovering control gaps.
- Community Edition
  Our completely free version of the runZero Platform is ideal for home use and environments with fewer than 100 assets.
Exposure Management. Redefined.

Overcoming legacy limitations requires a new approach to the attack surface — one that uncovers the hidden exposures you’ve been missing and targets the exploitable risks that matter most to your environment.

Learn more about runZero
Solutions
- Solutions
  Gain visibility, control the unknowns, and ensure compliance with confidence.
  
  Incident Response
  
  Unmanaged & Unknowns
  
  Vulnerability Management
  
  Mergers & Acquisitions
  
  Compliance & Insurance
- Regulatory Compliance
  Ensure compliance and stay resilient against evolving cyber threats.
  
  CSRB
  
  DORA
  
  NIST CSF & 800-171
  
  NIS2
  
  NYDFS
  
  PCI DSS
It’s time to move away from legacy vulnerability management

Legacy vulnerability scanners were built for a different time — when networks had clear perimeters, assets were reachable, and credential-based scanning was feasible across the board. That world doesn’t exist anymore.

Read More
Resources
- Resource Center
  Dive into a treasure trove of resources to expand your exposure management knowledge.
  
  Reports
  
  Webcasts
  
  Solution Briefs
- runZero Research
  Explore the world of exposure management through the runZero lens.
  
  Research Blogs
  
  Rapid Responses
  
  runZero Hour
- runZero Blog
  See what's happening at runZero and read up on the latest ideas, opinions, and articles from our experts and researchers.
- Support Resources
  Everything you need to maximize your experience with the runZero Platform.
  
  Documentation
  
  REST API
  
  Open Source
Watch the runZero Day replay!

The inaugural runZero Day livestream was one for the books! From the inner workings of the CVE program and modern cyber journalism to the realities of OT security and the startup investment ecosystem, our wonderful guests helped us cover the trends that are defining our industry.

Watch the Replay
Customers
- Our Customers
  Our customers are everything. We're super proud to be trusted by leading organizations around the globe to help them improve their security.
- Case Studies
  See how runZero has empowered security teams to take control of their networks, uncover their unknowns, and save significant time and money.
  
  North Carolina K-12
  
  Topcon
  
  Capgemini
  
  Presidio
  
  York University
- Testimonials
  Read reviews of the runZero Platform and see how teams have improved their security with our technology.
Info-Tech report confirms runZero as a leading CTEM solution

Info-Tech Research Group validates runZero as a reliable vendor solution for complex environments, highlighting its structured approach to CTEM, innovative agentless approach, and ability to detect full-spectrum exposure to deliver comprehensive visibility and rapid threat detection.

Read the Report
Partners
- Infinity Partner Program
  See how we can work together to provide best-in-class security solutions and outcomes for our joint customers.
- Partner Directory
  Explore our directory of trusted (and awesome) partners.
- Partner Sign In
  Sign in to our Infinity Partner Portal.
Join our Infinity Partner Program

Designed with a partner-first mindset, the runZero Infinity Partner Program offers incredibly valuable resources, relationships, and rewards to partners who choose to grow their business with us.

Become a runZero Partner
About
- About Us
  Wondering who the heck are these people? Meet the team and get the story behind runZero... once upon a time called Rumble.
- Events
  Track down runZero Yetis in the wild! Join us in-person or virtually at one of our upcoming events.
- Investors
  Meet the cybersecurity investors, trailblazers, and innovators who help us navigate our journey and the evolving security landscape.
- Newsroom
  Read the latest articles, announcements, and press releases from runZero.
- Careers
  Want to join our forces? We're looking for bright minds and passionate souls who want to write the next chapter in exposure management.
Tune in on April 15 – Live, Laugh, Malware: LLMs in Cybersecurity

Join Tod Beardsley and Rob King as they welcome Axari CSO Caroline Wong to discuss the dual nature of AI’s capabilities and provide an update on the evolving CVE ecosystem. Plus, bring your best AI-game to our live trivia contest for a chance to win a signed copy of her book!

Register Now
Pricing
Support
Contact Us
Sign In

🤖 April 15 – Live, Laugh, Malware: LLMs in Cybersecurity! Register Now

Exposure Management Platform
Complete security visibility across IT, OT, IoT, cloud, mobile, and remote assets.
Integrations
runZero seamlessly integrates with a wide variety of tools, enhancing network visibility, enriching asset data, and uncovering control gaps.
Community Edition
Our completely free version of the runZero Platform is ideal for home use and environments with fewer than 100 assets.

Exposure Management. Redefined.

Overcoming legacy limitations requires a new approach to the attack surface — one that uncovers the hidden exposures you’ve been missing and targets the exploitable risks that matter most to your environment.

Learn more about runZero

Solutions
Gain visibility, control the unknowns, and ensure compliance with confidence.
Regulatory Compliance
Ensure compliance and stay resilient against evolving cyber threats.
- CSRB
- DORA
- NIST CSF & 800-171
- NIS2
- NYDFS
- PCI DSS

It’s time to move away from legacy vulnerability management

Legacy vulnerability scanners were built for a different time — when networks had clear perimeters, assets were reachable, and credential-based scanning was feasible across the board. That world doesn’t exist anymore.

Read More

Resource Center
Dive into a treasure trove of resources to expand your exposure management knowledge.
runZero Research
Explore the world of exposure management through the runZero lens.
runZero Blog
See what's happening at runZero and read up on the latest ideas, opinions, and articles from our experts and researchers.
Support Resources
Everything you need to maximize your experience with the runZero Platform.

Watch the runZero Day replay!

The inaugural runZero Day livestream was one for the books! From the inner workings of the CVE program and modern cyber journalism to the realities of OT security and the startup investment ecosystem, our wonderful guests helped us cover the trends that are defining our industry.

Watch the Replay

Our Customers
Our customers are everything. We're super proud to be trusted by leading organizations around the globe to help them improve their security.
Case Studies
See how runZero has empowered security teams to take control of their networks, uncover their unknowns, and save significant time and money.
Testimonials
Read reviews of the runZero Platform and see how teams have improved their security with our technology.

Info-Tech report confirms runZero as a leading CTEM solution

Info-Tech Research Group validates runZero as a reliable vendor solution for complex environments, highlighting its structured approach to CTEM, innovative agentless approach, and ability to detect full-spectrum exposure to deliver comprehensive visibility and rapid threat detection.

Read the Report

About Us
Wondering who the heck are these people? Meet the team and get the story behind runZero... once upon a time called Rumble.
Events
Track down runZero Yetis in the wild! Join us in-person or virtually at one of our upcoming events.
Investors
Meet the cybersecurity investors, trailblazers, and innovators who help us navigate our journey and the evolving security landscape.
Newsroom
Read the latest articles, announcements, and press releases from runZero.
Careers
Want to join our forces? We're looking for bright minds and passionate souls who want to write the next chapter in exposure management.

Tune in on April 15 – Live, Laugh, Malware: LLMs in Cybersecurity

Join Tod Beardsley and Rob King as they welcome Axari CSO Caroline Wong to discuss the dual nature of AI’s capabilities and provide an update on the evolving CVE ecosystem. Plus, bring your best AI-game to our live trivia contest for a chance to win a signed copy of her book!

Register Now

Infinity Partner Program
See how we can work together to provide best-in-class security solutions and outcomes for our joint customers.
Partner Directory
Explore our directory of trusted (and awesome) partners.
Partner Sign In
Sign in to our Infinity Partner Portal.

Join our Infinity Partner Program

Designed with a partner-first mindset, the runZero Infinity Partner Program offers incredibly valuable resources, relationships, and rewards to partners who choose to grow their business with us.

Become a runZero Partner

On This Page:

Executive summary
Attacker value
Credit
Timeline

runZero Platform API credential information leak

todb

|

Updated April 7, 2026, 9:00am EDT

Vendors	runZero
Products	runZero Platform runZero Platform
Related	CVE-2026-5375

Products

	Product
1	runZero Platform

CVE

CVE-2026-5375

Executive summary #

An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved. This is an instance of CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N (2.7 Low). This issue was fixed in version 4.0.260203.0 of the runZero Platform.

Attacker value #

An authorized user with access to a particular integration credential could take advantage of this vulnerability to gain much more information about that saved credential than what is normally provided through the UI. If exploited, this could give the attacker valuable information about the internal workings of the target organization.

Credit #

This issue was discovered at runZero during a routine code security review.

Timeline #

2026-02-03 : Issue identified and fixed by the vendor

2026-04-07 : Published this advisory

Written by todb

Tod Beardsley is VP of Security Research at runZero, where he "kicks assets and fakes frames." Prior to 2025, he was the Section Chief for the Vulnerability Response section for CSD/VM/VRC at CISA, the Cybersecurity and Infrastructure Security Agency, part of the US government, and a seasonal Travis County Election Judge in Texas. He's also a founder and CNA point of contact for AHA!. Tod spends much of his time involved in vulnerability research and coordinated vulnerability disclosure (CVD). He has over 30 years of hands-on security experience, stretching from in-band telephony switching to modern ICS/OT implementations. He has held IT ops, security, software engineering, and management positions in large organizations such as the US Government, Rapid7, 3Com, Dell, and Westinghouse, as both an offensive and defensive practitioner. Tod is a CVE Board member, has authored several research papers, and is an internationally-tolerated horror fiction expert.

More about todb

runZero CAASM

© Copyright 2026 runZero, Inc. All Rights Reserved