CVE-2026-22806: vCluster Platform: scope bypass in limited-scope access keys

Overview

CVE-2026-22806 is a flaw in vCluster Platform, a Kubernetes platform for managing virtual clusters, multi-tenancy and cluster sharing. According to the description, an access key created with a limited scope can be used to reach resources outside that scope. The record classifies the weakness as Incorrect Authorization (CWE-863). The advisory published through GitHub is the primary cited source.

Impact

• The described effect is a bypass of the access key scope restriction.
• The description states that the attacker still cannot access resources beyond what the key owner can access, so the bypass is limited to the owner's effective permissions.
• The CVSS 3.1 vector in the record indicates network reachability, low complexity, high privileges required, changed scope, and high confidentiality, integrity and availability impact. The overall score is 9.1, rated critical by the record's data.

Affected products and versions

• The product is vCluster Platform.
• The description refers to versions prior to 4.6.0, 4.5.4, 4.4.2 and 4.3.10 as affected, and names 4.6.0, 4.5.4, 4.4.2 and 4.3.10 as the fixed versions.
• The structured affected and fixes fields in the record are empty, so the exact lower bounds of each affected range are unknown from the available data.

Exploitation status

• The record shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.
• No confirmed exploitation appears in the sources consulted.
• No EPSS score is present in the record.

Remediation and mitigation

• Upgrade to 4.6.0, 4.5.4, 4.4.2 or 4.3.10, depending on the release branch in use, as the description states these versions fix the vulnerability.
• Where an immediate upgrade is not possible, review access keys that are scoped and confirm that every user with access to them has appropriate permissions.
• As a temporary workaround where scoped keys are still needed, create automation users with very limited permissions and use access keys issued to those users instead.
• Apply the principle of least privilege to all access keys and rotate keys that are no longer required.

Detection guidance

• Review audit and access logs of the platform for access key activity that touches namespaces, clusters or resources outside the scope assigned to the key.
• Compare the scope recorded for each access key with the resources it actually accessed during the period in question.
• Inventory which access keys are scoped and which automation accounts they belong to, so that reviews can be prioritized.

Limitations of the available information

• The record does not include a vendor-maintained affected range or fixed-version list in structured form, so the description is the only source for version information.
• The description does not explain the technical mechanism of the bypass, and this analysis does not add any.
• Whether any environment has been affected cannot be determined from the record.
• The record has a source status of Deferred, and no additional advisory details beyond the cited GitHub advisory and NVD entries were available.

Frequently asked questions

What does CVE-2026-22806 allow?

According to the description, an access key created with a limited scope can be used to reach resources outside that scope in vCluster Platform. The description also states the user still cannot access anything beyond what the key owner can access.

Which versions are fixed?

The description names 4.6.0, 4.5.4, 4.4.2 and 4.3.10 as versions that fix the vulnerability. Versions prior to these are described as affected.

Is there a workaround if upgrading is not possible right away?

The description suggests reviewing scoped access keys and their users' permissions. It also mentions creating automation users with very limited permissions and using access keys issued to them as a temporary workaround.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.