The vulnerability lies in the handling of access keys in vCluster Platform. When a key is created with a limited scope, the scope can be bypassed, allowing the holder to interact with resources beyond the intended restrictions. Although the attacker remains bounded by the permissions that the key owner would normally have, the bypass effectively removes the intended scope guard, leading to unauthorized data or resource exposure. This represents a critical access control weakness (CWE‑863) that can compromise the isolation guarantees of virtual clusters.

Loft‑sh offers the vCluster Platform, which is affected in all releases prior to 4.6.0, 4.5.4, 4.4.2, and 4.3.10. Systems running those versions are vulnerable; upgrading to the mentioned fixed versions removes the defect.

The CVSS score is 9.1, indicating high severity. The EPSS score is below 1 %, meaning the probability of exploitation in the wild is currently low, and the issue is not recorded in CISA’s KEV catalog. Nonetheless, because the flaw involves an access key, an attacker who can create or obtain a key with limited scope could exploit the vulnerability by requesting operations that fall outside that scope, provided those operations would otherwise be permitted by the key owner’s permissions. The attack path leverages the existing key management infrastructure, so no additional foothold is required beyond possessing a legitimate access key. Organizations should treat this as a high‑risk exposure pending patch.