Vulnerability · Published May 14, 2026 · Assigned by GitHub_M

CVE-2026-42457vCluster Platform: Stored XSS can lead to privilege escalation

Critical 9.0

In plain English

A critical-severity cross-site scripting in loft from loft-sh. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)0.3%top 75.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context. In the worst case, a malicious user could potentially create a new Global-Admin user, bypassing other security restrictions. The attacker needs the ability to create namespaces. This vulnerability is fixed in 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0.

Affected products (as reported)

Vendor	Product	Versions
loft-sh	loft	< 4.4.3>=4.5.0-alpha.0 , < 4.5.5>= 4.6.0-alpha.1, < 4.6.2>= 4.7.0-alpha.0, < 4.7.1

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/loft-sh/loft/security/advisories/GHSA-x7cq-v3h6-426c x_refsource_CONFIRM