The vCluster Platform contains a stored cross‑site scripting flaw in the templateRef name field that allows a malicious user who can create namespaces to inject and execute arbitrary JavaScript. The injected code runs in the browser context of other users and can be used to create a new Global‑Admin account, giving the attacker full administrative control over the platform and all virtual clusters. This results in a loss of confidentiality, integrity, and availability through privilege escalation.

Affected products are Loft vCluster Platform releases prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0. All versions that do not include the patch are vulnerable; upgrading to any of the patched releases eliminates the flaw.

The CVSS score of 9 highlights a very high risk, and the lack of an EPSS score or KEV listing indicates the vulnerability has not yet been widely exploited publicly. However, the flaw requires only the ability to create namespaces, a capability that can be granted to trusted developers or collaborators. Once that condition is satisfied, the stored XSS can execute scripts with the associated user’s privileges, enabling attackers to forge privileged roles and compromise the entire cluster management environment.