CVE-2026-39910 — STACKIT IaaS API Privilege Escalation via Service Account Attachment
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise …
Published: 2026-06-08 · CVSS: 8.7 · CVSS 4.0
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7