vCluster Platform Critical XSS (CVE-2026-42457) Bypasses Admin Restrictions
The National Vulnerability Database has disclosed CVE-2026-42457, a critical stored Cross-Site Scripting (XSS) vulnerability impacting vCluster Platform. This flaw, present in versions prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, allows for arbitrary external script execution within the platform’s browser context. The vulnerability resides in the name field of a templateRef.
An attacker exploiting this weakness, provided they have the ability to create namespaces, could elevate privileges to create a new Global-Admin user. This effectively bypasses existing security restrictions, granting full control over the vCluster environment. The National Vulnerability Database assigns this a CVSS score of 9.0 (CRITICAL), underscoring the severe impact.
This isn’t just a nuisance XSS; it’s a full privilege escalation. For environments relying on vCluster for multi-tenancy and virtual cluster management, this means a compromised user with namespace creation privileges can seize administrative control. Defenders need to recognize the attacker’s calculus here: XSS is merely the vector to achieve a far more destructive outcome.
What This Means For You
- If your organization uses vCluster Platform for Kubernetes management, you must immediately verify your version. Patching to 4.4.3, 4.5.5, 4.6.2, 4.7.1, or 4.8.0 is non-negotiable. Audit user permissions, especially those with namespace creation capabilities, and monitor for any anomalous `Global-Admin` user creation or suspicious script executions.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-42457 - vCluster Platform Stored XSS via templateRef Name
title: CVE-2026-42457 - vCluster Platform Stored XSS via templateRef Name
id: scw-2026-05-14-ai-1
status: experimental
level: critical
description: |
Detects the specific Stored XSS vulnerability in vCluster Platform (CVE-2026-42457) by looking for POST requests to the template-refs API endpoint where the 'name' parameter contains a script tag and an alert function, indicative of an XSS payload attempting to execute arbitrary JavaScript.
author: SCW Feed Engine (AI-generated)
date: 2026-05-14
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42457/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/api/v1/template-refs'
cs-method:
- 'POST'
cs-uri-query|contains:
- 'name='
cs-uri-query|contains:
- '<script>'
cs-uri-query|contains:
- 'alert('
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42457 | XSS | vCluster Platform < 4.4.3 |
| CVE-2026-42457 | XSS | vCluster Platform < 4.5.5 |
| CVE-2026-42457 | XSS | vCluster Platform < 4.6.2 |
| CVE-2026-42457 | XSS | vCluster Platform < 4.7.1 |
| CVE-2026-42457 | XSS | vCluster Platform < 4.8.0 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 14, 2026 at 18:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-42589: Gotenberg RCE via ExifTool Argument Injection
CVE-2026-42589 — Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg's /forms/pdfengines/metadata/write HTTP endpoint accepts a JSON metadata object and passes...
CVE-2026-42283: DevSpace UI WebSocket Exposes Developer Endpoints
CVE-2026-42283 — DevSpace is a client-only developer tool for cloud-native development with Kubernetes. Prior to 6.3.21, DevSpace's UI server WebSocket accepts connections from all origins...
CVE-2026-40893: Gotenberg Allows Arbitrary File Manipulation
CVE-2026-40893 — Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName...