CVE-2026-42457 vCluster Platform: Stored XSS can lead to privilege escalation
Stored XSS in vCluster Platform allows attackers to execute scripts and escalate privileges to Global-Admin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-42457?
CVE-2026-42457 is a critical cross-site scripting vulnerability in loft-sh loft, published on 14 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a templateRef. This can lead to the execution of arbitrary external scripts within the platform's browser context. In the worst case, a malicious user could potentially create a new Global-Admin user, bypassing other security restrictions. The attacker needs the ability to create namespaces. This vulnerability is fixed in 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-42457?
How do I fix CVE-2026-42457?
No fix has been published for CVE-2026-42457 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-42457 being exploited?
There is no known exploitation of CVE-2026-42457 in the wild and no public exploit code.
Sources
Also known as GHSA-x7cq-v3h6-426c.