TI-2026-84340 Aliases CVE-2026-110265 GHSA-prhh-mv99-87h8

SQL injection in runZero search exposes other organizations' results

LOW 29CWE-89Published 2026-11-03 · Updated 2026-11-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

runZero Platform versions from 0 before 5.1.261013.1 are affected by an SQL injection flaw (CWE-89) in search. A specially crafted malformed search query can return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00343 27th percentileScored 2026-11-07

Fix Fixed Platform (runZero): 5.1.261013.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
runZero	Platform	before 5.1.261013.1	5.1.261013.1	Patch available	CNA

Platform VendorrunZero Affected before 5.1.261013.1 Fixed in 5.1.261013.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:runzero:runzero_platform::::::::	—	—	runZero

cpe:2.3:a:runzero:runzero_platform:*:*:*:*:*:*:*:* Versions — — ·runZero

Remediation

Upgrade runZero Platform to version 5.1.261013.1, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Fix · CNA Platform (runZero) Fixed in 5.1.261013.1

Timeline

2026-11-03 Threatist record created from CVE-2026-110265
2026-11-03 Alias added: GHSA-prhh-mv99-87h8
2026-11-03 CISA SSVC decision points changed
2026-11-03 Priority changed: MEDIUM → LOW

References

Advisory 1

https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265

Other 1

https://help.runzero.com/docs/release-notes/#512610131

TI-2026-04701 runZero Platform superuser privilege escalation CVSS 3.1HIGH 8.4
TI-2026-04700 runZero Platform SQL injection in saved queries CVSS 3.1MEDIUM 6.4
TI-2026-04706 runZero Platform user creation leak CVSS 3.1MEDIUM 6.8
TI-2026-04704 runZero Platform session timeout failure CVSS 3.1MEDIUM 5.9
TI-2026-04712 runZero Platform incorrect credential scope CVSS 3.1MEDIUM 5.8
TI-2026-04702 runZero Platform MCP information leak CVSS 3.1MEDIUM 5.8

See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences