Critical · published January 29, 2026
🚨 Bypass alert! With specific access keys in vCluster prior to version 4.6.0, sneaky users can slip through limitations like a kid slipping past a poorly supervised playground gate! 🔥 Think of it as giving someone a ticket to a specific section in a concert, only for them to waltz into the VIP area where they don't belong. Limited access? Not so limited after all! This vulnerability could allow users to access resources they shouldn't, potentially exposing sensitive data or leading to unauthorized changes. While they can't reach everything, what they can access could still be absolutely devastating for your cluster's security!
Think of it as giving someone a ticket to a specific section in a concert, only for them to waltz into the VIP area where they don't belong. Limited access? Not so limited after all! This flaw allows a bypass of scoped access permissions for access keys in vCluster, meaning users can potentially access resources outside their intended restrictions, even if they can't reach everything their owner can.
This vulnerability could allow users to access resources they shouldn't, potentially exposing sensitive data or leading to unauthorized changes. While they can't reach everything, what they can access could still be absolutely devastating for your cluster's security! Upgrade to versions 4.6.0, 4.5.4, 4.4.2, or 4.3.10 immediately to close this loophole. In the meantime, review existing access keys and ensure that users have appropriate permissions. As a workaround, consider creating automation users with very limited permissions! You've got this! Implement these changes, and you'll be back in control of your virtual clusters in no time! 🛡️