CVE-2026-42457: vCluster Platform: Stored XSS via templateRef name leading to privilege escalation
CVE-2026-42457 is a stored cross-site scripting flaw (CWE-79) in vCluster Platform, reached through the name field of a templateRef. According to the record, it can run scripts in the platform browser context and, in the worst case, allow creation of a Global-Admin user, and the attacker needs the ability to create namespaces. The record rates it critical with CVSS 3.1 score 9.0 and lists fixed versions 4.4.3, 4.5.5, 4.6.2, 4.7.1 and 4.8.0.
Overview
CVE-2026-42457 affects vCluster Platform, a Kubernetes platform for managing virtual clusters, multi-tenancy and cluster sharing. The weakness is a stored cross-site scripting issue (CWE-79) triggered through the name field of a templateRef. The GitHub advisory referenced in the record is the primary source for the vendor's description.
Impact
- The record states that the flaw can lead to execution of arbitrary external scripts within the platform browser context.
- In the worst case, the record says a malicious user could potentially create a new Global-Admin user and bypass other security restrictions.
- The record states that the attacker needs the ability to create namespaces.
- The CVSS 3.1 base score is 9.0 with the critical severity label, with high confidentiality, integrity and availability impact in the record's vector.
Affected products and versions
The record lists the product as Loft-sh Loft with these ranges:
- Versions before 4.4.3.
- Versions from 4.5.0-alpha.0 up to, but not including, 4.5.5.
- Versions from 4.6.0-alpha.1 up to, but not including, 4.6.2.
- Versions from 4.7.0-alpha.0 up to, but not including, 4.7.1.
The description also names 4.8.0 as a fixed release, but 4.8.0 does not appear in the affected ranges. Treat this as an inconsistency in the record and confirm the exact boundary in the vendor advisory before drawing conclusions for 4.8.x.
Exploitation status
The record marks the CVE as not listed in the CISA KEV catalog and gives an SSVC exploitation value of none with automatable set to no. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade vCluster Platform to a fixed release: 4.4.3, 4.5.5, 4.6.2, 4.7.1 or 4.8.0, matching your release line.
- Until patching is complete, review which users can create namespaces, since the record states this capability is required, and restrict it to trusted roles.
- Review existing templateRef objects and recently created namespaces for unexpected names or content.
- Audit accounts with Global-Admin rights for entries that were not created through approved processes.
Detection guidance
- Review audit logs for namespace creation and for templateRef creation or modification by unexpected identities.
- Look for newly created users or role bindings that grant global administrative rights.
- Monitor the platform for unusual browser-side behaviour reported by administrators, such as unexpected pop-ups or actions performed in their session.
Limitations of the available information
The record does not include a fixed-version list in its structured fields, so the fixed versions above come from the description. It does not describe the exact conditions for exploitation beyond the namespace-creation requirement, and it does not provide proof of concept details, which this analysis does not include. The EPSS data in the record carries a date that does not match the publication date, so the probability value should be read with caution.
Frequently asked questions
What is CVE-2026-42457?
It is a stored cross-site scripting vulnerability in vCluster Platform, triggered through the name field of a templateRef, according to the record.
Which versions are fixed?
The record lists 4.4.3, 4.5.5, 4.6.2, 4.7.1 and 4.8.0 as fixed releases. Match the release to your own release line.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.