CVE-2026-39910: STACKIT IaaS API Privilege Escalation via Service Account Attachment
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement and enforce proper authorization checks on the PUT /servers/service-accounts endpoint so only authorized administrative principals can attach service accounts to virtual machines.
STACKIT IaaS API (PUT /servers/service-accounts endpoint) authorization_check = enforce - Configuration
If a code fix is not yet available, temporarily disable the ability to attach service accounts to existing VMs until authorization is implemented and verified.
STACKIT IaaS API allow_attaching_service_accounts_to_vms = disable (temporary) - Configuration
Restrict or block access to the Instance Metadata Service from user-controlled VMs that should not be able to retrieve service account OAuth2 tokens (apply network policies or metadata access controls).
Instance Metadata Service access from tenant VMs = restrict/block - Compensating control
Restrict access to the servers service-accounts API (e.g., via firewall rules, API gateway, or IAM policies) to trusted administrative networks/roles until a permanent fix is deployed.
- Operational
Audit recent PUT /servers/service-accounts calls and Instance Metadata Service access to identify unauthorized attachments and token retrieval; detach any unauthorized service accounts and remediate affected VMs (e.g., reprovision) as needed.
- Operational
Rotate OAuth2 tokens, service account keys, and any credentials that may have been exposed via the Instance Metadata Service for impacted projects/organization.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39910?
CVE-2026-39910 has a critical severity rating of 9.8.
How do I fix CVE-2026-39910?
To fix CVE-2026-39910, ensure that strict authorization checks are implemented for service account attachments in STACKIT IaaS API.
What type of vulnerability is CVE-2026-39910?
CVE-2026-39910 is a privilege escalation vulnerability that allows unauthorized escalation of privileges.
Who is affected by CVE-2026-39910?
Any users with low privileges in the STACKIT IaaS API environment can potentially be affected by CVE-2026-39910.
What impact does CVE-2026-39910 have on organizations?
CVE-2026-39910 can lead to full organizational compromise due to unauthorized privilege escalation.