CVE-2026-81846CWE-639

CVE-2026-81846

Low · published September 1, 2026

CVSS v3.1
3.5
EPSS
0%
Percentile
17.8
In the wild
Unconfirmed
What it is

An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypass Through User-Controlled Key and has an estimated CVSS score of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N (3.5 Low).

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00267 · 17.8th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-01T23:17Z
References (2)
https://help.runzero.com/docs/release-notes/#512608260 · 44488dab-36db-4358-99f9-bc116477f914https://www.runzero.com/advisories/runzero-mcp-findings-summaries-data-leak-cve-2026-81846 · 44488dab-36db-4358-99f9-bc116477f914
EPSS history
Timeline
  • 03 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 01 SEP 19:04Z
    runZero MCP 'Findings summaries' Data Leak
    cvelistv5