CVE-2026-22806

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22806", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.288Z", "datePublished": "2026-01-29T19:54:37.810Z", "dateUpdated": "2026-01-29T21:19:58.653Z"}, "containers": {"cna": {"title": "vCluster Platform's Access Keys Allows Access Beyond Scope", "problemTypes": [{"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq"}], "affected": [{"vendor": "loft-sh", "product": "loft", "versions": [{"version": "< 4.3.10", "status": "affected"}, {"version": ">= 4.4.0, < 4.4.2", "status": "affected"}, {"version": ">= 4.5.3, < 4.5.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T19:54:37.810Z"}, "descriptions": [{"lang": "en", "value": "vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user still cannot access resources beyond what is accessible to the owner of the access key. Versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 fix the vulnerability. Some other mitigations are available. Users can limit exposure by reviewing access keys which are scoped and ensuring any users with access to them have appropriate permissions set. Creating automation users with very limited permissions and using access keys for these automation users can be used as a temporary workaround where upgrading is not immediately possible but scoped access keys are needed."}], "source": {"advisory": "GHSA-c539-w4ch-7wxq", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T21:05:24.579499Z", "id": "CVE-2026-22806", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:19:58.653Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22806", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-29T21:05:24.579499Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T21:19:54.796Z"}}], "cna": {"title": "vCluster Platform's Access Keys Allows Access Beyond Scope", "source": {"advisory": "GHSA-c539-w4ch-7wxq", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "loft-sh", "product": "loft", "versions": [{"status": "affected", "version": "< 4.3.10"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.2"}, {"status": "affected", "version": ">= 4.5.3, < 4.5.3"}]}], "references": [{"url": "https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq", "name": "https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user still cannot access resources beyond what is accessible to the owner of the access key. Versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 fix the vulnerability. Some other mitigations are available. Users can limit exposure by reviewing access keys which are scoped and ensuring any users with access to them have appropriate permissions set. Creating automation users with very limited permissions and using access keys for these automation users can be used as a temporary workaround where upgrading is not immediately possible but scoped access keys are needed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-29T19:54:37.810Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22806", "state": "PUBLISHED", "dateUpdated": "2026-01-29T21:19:58.653Z", "dateReserved": "2026-01-09T22:50:10.288Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-29T19:54:37.810Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "loft", "vendor": "loft-sh", "versions": [{"status": "affected", "version": "< 4.3.10"}, {"status": "affected", "version": ">= 4.4.0, < 4.4.2"}, {"status": "affected", "version": ">= 4.5.3, < 4.5.3"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user still cannot access resources beyond what is accessible to the owner of the access key. Versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 fix the vulnerability. Some other mitigations are available. Users can limit exposure by reviewing access keys which are scoped and ensuring any users with access to them have appropriate permissions set. Creating automation users with very limited permissions and using access keys for these automation users can be used as a temporary workaround where upgrading is not immediately possible but scoped access keys are needed."}, {"lang": "es", "value": "vCluster Platform proporciona una plataforma Kubernetes para la gesti\u00f3n de cl\u00fasteres virtuales, multitenencia y el uso compartido de cl\u00fasteres. Antes de las versiones 4.6.0, 4.5.4, 4.4.2 y 4.3.10, cuando se crea una clave de acceso con un alcance limitado, el alcance puede ser eludido para acceder a recursos fuera de este. Sin embargo, el usuario a\u00fan no puede acceder a recursos m\u00e1s all\u00e1 de lo que es accesible para el propietario de la clave de acceso. Las versiones 4.6.0, 4.5.4, 4.4.2 y 4.3.10 corrigen la vulnerabilidad. Algunas otras mitigaciones est\u00e1n disponibles. Los usuarios pueden limitar la exposici\u00f3n revisando las claves de acceso que tienen un alcance definido y asegur\u00e1ndose de que cualquier usuario con acceso a ellas tenga los permisos apropiados configurados. La creaci\u00f3n de usuarios de automatizaci\u00f3n con permisos muy limitados y el uso de claves de acceso para estos usuarios de automatizaci\u00f3n puede utilizarse como una soluci\u00f3n alternativa temporal donde la actualizaci\u00f3n no es posible de inmediato pero se necesitan claves de acceso con alcance definido."}], "id": "CVE-2026-22806", "lastModified": "2026-06-17T10:20:27.793", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22806", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T21:05:24.579499Z", "version": "2.0.3"}}]}, "published": "2026-01-29T20:16:10.277", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/loft-sh/loft/security/advisories/GHSA-c539-w4ch-7wxq"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:22:11.647065+00:00", "value": {"mitigation_remediation": ["Upgrade to a fixed version of vCluster Platform (4.6.0 or later, or 4.5.4, 4.4.2, or 4.3.10, depending on your environment).", "Review and revoke any scoped access keys that may have been created before the fix, and generate new keys with properly scoped permissions.", "If upgrading cannot be performed immediately, create automation users with the minimum permissions necessary for your automation tasks, issue access keys to those users, and avoid using keys that were created with arbitrary scopes.", "Ensure that user roles assigned to automation users are restricted to the specific resources they need, limiting potential impact of any future key vulnerabilities."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized resource access due to scope bypass in access keys"}, "threat_synthesis": {"affected_systems": "Loft\u2011sh offers the vCluster Platform, which is affected in all releases prior to 4.6.0, 4.5.4, 4.4.2, and 4.3.10. Systems running those versions are vulnerable; upgrading to the mentioned fixed versions removes the defect.", "description_and_impact": "The vulnerability lies in the handling of access keys in vCluster Platform. When a key is created with a limited scope, the scope can be bypassed, allowing the holder to interact with resources beyond the intended restrictions. Although the attacker remains bounded by the permissions that the key owner would normally have, the bypass effectively removes the intended scope guard, leading to unauthorized data or resource exposure. This represents a critical access control weakness (CWE\u2011863) that can compromise the isolation guarantees of virtual clusters.", "risk_and_exploitability": "The CVSS score is 9.1, indicating high severity. The EPSS score is below 1\u202f%, meaning the probability of exploitation in the wild is currently low, and the issue is not recorded in CISA\u2019s KEV catalog. Nonetheless, because the flaw involves an access key, an attacker who can create or obtain a key with limited scope could exploit the vulnerability by requesting operations that fall outside that scope, provided those operations would otherwise be permitted by the key owner\u2019s permissions. The attack path leverages the existing key management infrastructure, so no additional foothold is required beyond possessing a legitimate access key. Organizations should treat this as a high\u2011risk exposure pending patch."}}}}, "created": "2026-01-30T08:42:40.583797+00:00", "updated": "2026-04-18T01:30:16.037804+00:00", "vendors": ["loft-sh", "loft-sh$PRODUCT$loft"]}