CVE-2026-5372
SQL Injection in runZero Saved Queries Allows Data Compromise
Publication date: 2026-04-07
Last updated on: 2026-04-21
Assigner: 44488dab-36db-4358-99f9-bc116477f914
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| runzero | runzero_platform | 4.0.260123.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-5372 is a SQL injection vulnerability in the runZero Platform related to saved queries introduced in version 4.0.260123.0.
This vulnerability falls under CWE-89, which means it involves improper neutralization of special elements used in an SQL command, allowing malicious SQL code to be injected.
An authenticated attacker can insert a malicious SQL payload into a saved query. When another user executes that saved query, the injected SQL commands can compromise the database.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to serious impacts on the platform's database.
- Dropping database tables.
- Inserting invalid data.
- Performing unauthorized modifications to platform data.
Overall, it can compromise the confidentiality, integrity, and availability of the platform's data.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability was fixed in version 4.0.260123.1 of the runZero Platform.
To mitigate this vulnerability, you should immediately upgrade your runZero Platform to version 4.0.260123.1 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the SQL injection vulnerability in the runZero Platform (CVE-2026-5372) affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves SQL injection through saved queries in the runZero Platform version 4.0.260123.0. Detection typically requires identifying malicious or unexpected SQL payloads within saved queries or monitoring for abnormal database behavior triggered by these queries.
Since exploitation requires authenticated access and user interaction, detection can include auditing saved queries for suspicious SQL syntax or payloads, and monitoring logs for unusual query executions.
Specific commands to detect this vulnerability are not provided in the available resources.