CVE-2026-42457 -- CVSS 9.0 Vulnerability Briefing

CVE-2026-42457 | CVSS 9.0 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-42457 is a stored cross-site scripting (XSS) vulnerability in the vCluster Platform, a Kubernetes management product used for virtual cluster orchestration, multi-tenancy, and cluster sharing.

Technical Detail

The flaw allows an attacker to inject and persistently store malicious scripts within the vCluster Platform interface, which are then executed in the browsers of other users who access the affected content. Stored XSS of this nature typically enables session hijacking, credential theft, or execution of unauthorized actions in the context of the victim's authenticated session, including those of platform administrators. Given the Kubernetes management context, a successful attack could facilitate lateral movement into cluster administration functions or tenant environments. The vulnerability is present in all versions prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0.

Exploitation Status

No known exploit code has been identified at this time, and this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. There is no confirmed public proof-of-concept or evidence of active exploitation in the wild as of May 21, 2026.

Who Is Targeting This

No specific threat actor attribution at this time. No campaigns or targeted sectors have been associated with this vulnerability in available intelligence.

What To Do

Organizations running vCluster Platform should upgrade immediately to one of the patched releases: 4.4.3, 4.5.5, 4.6.2, 4.7.1, or 4.8.0, depending on the version branch in use. Given the CVSS score of 9.0 and the administrative attack surface involved, this should be treated as a high-priority patch. If immediate patching is not feasible, restrict access to the vCluster Platform web interface to trusted internal networks or VPN-only access to reduce exposure. Monitor platform audit logs for unexpected session activity or unauthorized configuration changes as a detection signal pending patch deployment.