What is CVE-2026-42457?

CVE-2026-42457 is a critical-severity vulnerability in Loft-sh Loft, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-05-14.

How severe is CVE-2026-42457?

Critical severity. CVSS v3 base score is 9.0 out of 10.

XSS in Loft-sh Loft

CVE-2026-42457

vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a Stored XSS attack vulnerability via the name field of a template…

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.000 (15.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.

Affected products

Loft-sh Loft — versions < 4.4.3, >=4.5.0-alpha.0 , < 4.5.5, >= 4.6.0-alpha.1, < 4.6.2

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

security-advisories@github.com (x_refsource_CONFIRM)

Frequently asked questions

What is CVE-2026-42457?: CVE-2026-42457 is a critical-severity vulnerability in Loft-sh Loft, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-05-14.
How severe is CVE-2026-42457?: Critical severity. CVSS v3 base score is 9.0 out of 10.