PT-2026-47345 · Stackit · Iaas Api

Lior Fatiha · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-39910

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-39910

Affected Products

Iaas Api

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39910 · Security Note
• https://status.stackit.cloud · Note
• https://vulncheck.com/advisories/stackit-iaas-api-privilege-escalation-via-service-account-attachment · Note