CVE-2026-39910
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Missing authorization check in STACKIT IaaS API allows authenticated low-privileged attackers to escalate privileges by attaching service accounts to VMs, leading to full organization compromise.
Risk Assessment
An attacker can retrieve OAuth2 tokens and gain unauthorized control over the entire organization environment, bypassing tenant boundaries.
Recommendation
Apply the STACKIT patch and restrict access to the PUT servers service-accounts endpoint.
Original NVD description (English source)
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.