CVE-2026-39910: STACKIT IaaS API Privilege Escalation via Service Account Attachment

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-08 · updated 2026-10-30
Weakness: CWE-862

Description

STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service account to a virtual machine they control without validation of their permission to use it, then query the Instance Metadata Service (IMDS) to retrieve an OAuth2 token for that service account and act with its privileges. The impact is confined to the attacker’s own project. The STACKIT Identity Provider enforces strict project matching between the target VM and the requested service account during token impersonation, so cross-project and cross-organization exploitation is not possible. Any further access is bounded by the IAM roles already assigned to the targeted service account.

Affected products

STACKIT IaaS API: before 2026-05-28 — fixed in 2026-05-28

How to fix

Upgrade to a fixed version: STACKIT IaaS API 2026-05-28. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-39910 or the next vulnerability affects your stack