CVE-2026-42457 is a stored cross-site scripting vulnerability (CWE-79) in loft-sh's vCluster Platform affecting versions prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0. The vulnerability occurs due to improper input neutralization in the name field of a templateRef, enabling attackers with namespace creation privileges to inject malicious scripts that execute within the platform's browser context. This can lead to severe impacts including the creation of a Global-Admin user, effectively bypassing security controls. The CVSS 3.1 base score is 9.0 (AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, required privileges, user interaction, scope change, and high impact on confidentiality, integrity, and availability. Although no vendor advisory or patch links are provided, the presence of fixed versions indicates that upgrading to 4.4.3 or later (and corresponding versions) mitigates the vulnerability.

If exploited, this vulnerability allows an attacker with the ability to create namespaces to execute arbitrary scripts within the platform's browser context. This can lead to privilege escalation, including unauthorized creation of Global-Admin users, compromising the confidentiality, integrity, and availability of the system. The critical CVSS score reflects the high potential impact on system security and administration.

Upgrade affected loft-sh vCluster Platform installations to version 4.4.3, 4.5.5, 4.6.2, 4.7.1, or 4.8.0 or later, as these versions contain fixes for this vulnerability. Since no official vendor advisory or patch links are provided, verify the upgrade path and patch details with the vendor's official release notes or security advisories. Restrict namespace creation privileges to trusted users to reduce risk until the update is applied.