PatchTheCVECVE-2026-5374: An issue that allowed MCP agents to access remediation and asset information from outside of the authorized or
CVE-2026-5374 is a medium-severity flaw (CVSS 5.8) affecting runzero platform. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N (5.8 Medium). This issue was fixed in version 4.0.260202.0 of the runZero Platform.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.8 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | High |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 89%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2026-04-07 |
| Last modified | 2026-10-26 |
Last updated 2026-10-26 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-5374?
runzero platform: upgrade to 4.0.260202.0. Exact commands for each OS are on this page.
Is CVE-2026-5374 being exploited?
CVE-2026-5374 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-5374 affect?
CVE-2026-5374 affects runzero platform. Severity is medium (CVSS 5.8). An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, and has an estimated CVSS score of CV
How urgent is CVE-2026-5374?
Priority 23/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-5372 MEDIUM 6.4 DOWNGRADE An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123
- CVE-2026-5376 MEDIUM 5.9 UPGRADE An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has be
- CVE-2026-5373 HIGH 8.1 UPGRADE An issue that allowed all-organization administrators to promote accounts to superuser status has been resolve
- CVE-2026-5384 MEDIUM 5.8 UPGRADE An issue that could allow a credential to be updated and used for a task from outside of the authorized organi
- CVE-2026-5378 MEDIUM 5.8 UPGRADE An issue that allowed administrators to create and update users outside of their authorized organization scope