Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Authorized users can see some secret credentials in plain text

CVE-2026-5380 · published 7 months ago
Summary

Authorized users of the runZero Platform can see secret credentials for some types of credentials. This is a security risk because sensitive information might be exposed. The issue is fixed in version 4.0.260204.2, so update to this version to be secure.

Original advisory text
An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected C...
An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved. This is an instance of CWE-522: Insufficiently Protected Credentials, and has an estimated CVSS score of
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N (5.3 Medium). This issue was fixed in version 4.0.260204.2 of the runZero Platform.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published7 Apr 2026
Updated4 Nov 2026
First seen7 Apr 2026
Sources
CVE-2026-5380 · NVD
Track software like this
Free during beta