CVE-2026-39910: Stackit Iaas API

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.

Affected products

• Stackit Iaas API: before 2026-05-28 (fixed in 2026-05-28)

Published 2026-06-08. Last modified 2026-08-24.