CVE-2026-22806
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created ...
Affects 0 products across 5 vendors.
Software performs an authorization check incorrectly, allowing access beyond intended privileges.
A vulnerability in vCluster Platform prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 allows an attacker to bypass the scope of an access key, potentially accessing resources outside of its intended scope. However, the attacker cannot access resources beyond what is accessible to the owner of the access key.
BSID: BS-2026-GLOBAL-276482-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2026-22806?
What is the CVSS score for CVE-2026-22806?
Is CVE-2026-22806 actively exploited?
How do I remediate CVE-2026-22806?
What systems are affected by CVE-2026-22806?
| CVE ID | CVE-2026-22806 |
|---|---|
| BSID | BS-2026-GLOBAL-276482-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| Published | 2026-01-29 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Domains | |
| Source | NVD |
vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10, when an access key is created with a limited scope, the scope can be bypassed to access resources outside of it. However, the user still cannot access resources beyond what is accessible to the owner of the access key. Versions 4.6.0, 4.5.4, 4.4.2, and 4.3.10 fix the vulnerability. Some other mitigations are available. Users can limit exposure by reviewing access keys which are scoped and ensuring any users with access to them have appropriate permissions set. Creating automation users with very limited permissions and using access keys for these automation users can be used as a temporary workaround where upgrading is not immediately possible but scoped access keys are needed.
Source: NIST NVD / MITRE CVE Database
The attack vector involves creating an access key with a limited scope and then exploiting a flaw in the scope enforcement mechanism to access resources outside of the intended scope. This can be achieved by manipulating the access key or the way it is validated by the system.
Exploitation Likelihood: MEDIUM
| Vendor | Product | Affected Versions |
|---|---|---|
| Beyond | — | — |
| Cannot | — | — |
| Kubernetes | — | — |
| Platform | — | — |
| Tenancy | — | — |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | a7323462ab001434262faceb7ec2bbdd272ebc79d412e3668d1f14e7c2607cae8322c927d9c702d9f4ddb6391c4065cc95bd33387a3b1b11de09d58a784cda0d |
Critical Severity - Know Your Exposure
A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →