Cloudanix VulnDB

CVE-2026-39910

High · 8.8

CVSS

8.8

EPSS

0.5%

Published

Jun 8, 2026

CISA due date

—

The record

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities