CVE-2026-110265 PUBLISHED

runZero search SQL injection

Assigner: runZero
Reserved: 13.10.2026 Published: 03.11.2026 Updated: 03.11.2026

A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 6.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	Low	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	runZero
Product	Platform
Versions	Default: unaffected affected from 0 to 5.1.261013.1 (excl.)

Credits

Corey Holland of runZero finder
Tod Beardsley of runZero coordinator

References

https://www.runzero.com/advisories/runzero-search-sqli-cve-2026-110265
https://help.runzero.com/docs/release-notes/#512610131

Problem Types

CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection') CWE