Vulnerability · Published Jun 8, 2026 · Assigned by VulnCheck
CVE-2026-39910STACKIT IaaS API Privilege Escalation via Service Account Attachment
High 8.8
In plain English
A high-severity missing authorization in IaaS API from STACKIT. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service account to a virtual machine they control without validation of their permission to use it, then query the Instance Metadata Service (IMDS) to retrieve an OAuth2 token for that service account and act with its privileges. The impact is confined to the attacker’s own project. The STACKIT Identity Provider enforces strict project matching between the target VM and the requested service account during token impersonation, so cross-project and cross-organization exploitation is not possible. Any further access is bounded by the IAM roles already assigned to the targeted service account.
Affected products (as reported)
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://status.stackit.cloud release-notes
- https://www.vulncheck.com/advisories/stackit-iaas-api-privilege-escalation-via-service-account-attachment third-party-advisory