CVE-2026-39910: STACKIT IaaS API Privilege Escalation

CVE-2026-39910 Overview

CVE-2026-39910 is a missing authorization vulnerability [CWE-862] in the STACKIT Infrastructure-as-a-Service (IaaS) API. The flaw resides in the PUT servers service-accounts endpoint, which fails to validate whether the requesting user owns the service account being attached to a virtual machine. Authenticated low-privileged attackers can attach arbitrary high-privileged service accounts to virtual machines they control. Once attached, the attacker queries the Instance Metadata Service (IMDS) from the compromised VM to retrieve OAuth2 tokens belonging to the borrowed service account. This bypasses tenant isolation boundaries and grants control over the entire organization environment.

Critical Impact
Authenticated attackers with minimal privileges can compromise an entire STACKIT organization tenant by harvesting OAuth2 tokens for high-privileged service accounts.

Affected Products

STACKIT IaaS API
STACKIT Compute service (virtual machines with service account attachment)
STACKIT Instance Metadata Service (IMDS) token issuance

Discovery Timeline

2026-06-08 - CVE-2026-39910 published to the National Vulnerability Database
2026-06-09 - CVE record last modified in NVD

Technical Details for CVE-2026-39910

Vulnerability Analysis

The vulnerability is a broken access control flaw classified under [CWE-862] Missing Authorization. The STACKIT IaaS API exposes an endpoint that attaches service accounts to compute instances. Service accounts in cloud environments carry their own identity and permission scope, often elevated for automation tasks. The API endpoint accepts a service account identifier without verifying that the calling principal is authorized to assume or delegate that account. Because the bound VM can retrieve credentials for whatever service account is attached, the missing check converts a low-privileged role into full organization control. The flaw violates tenant boundaries within a shared cloud environment, making lateral movement between customers feasible from a single authenticated foothold.

Root Cause

The root cause is the absence of an ownership and permission check on the PUT servers service-accounts endpoint. The API trusts the supplied service account identifier without verifying that the caller has rights to attach that specific identity. No tenant scoping or role-based authorization is enforced before the binding is written, so any authenticated user can specify any service account known to the platform.

Attack Vector

The attack is network-reachable, requires no user interaction, and needs only standard authenticated API access. An attacker first provisions or selects a virtual machine they control inside STACKIT. They then issue a PUT request against the servers service-accounts endpoint, supplying the identifier of a high-privileged service account belonging to another tenant or to the organization root. The API attaches the account without authorization checks. The attacker logs into their VM, queries the Instance Metadata Service, and receives an OAuth2 bearer token scoped to the attached service account. This token is then used against STACKIT control-plane APIs to read, modify, or destroy resources across the organization.

No verified exploit code is published. See the VulnCheck Security Advisory for additional technical context.

Detection Methods for CVE-2026-39910

Indicators of Compromise

PUT requests to the STACKIT IaaS servers service-accounts endpoint where the caller identity and the target service account belong to different ownership scopes.
IMDS token requests from virtual machines shortly after a service account attachment event involving an unrelated principal.
Use of OAuth2 tokens issued to high-privileged service accounts from source VMs that have no historical association with that account.

Detection Strategies

Correlate IaaS audit logs of service account attachment operations against identity logs to flag attachments where the requestor lacks ownership of the attached account.
Baseline expected service account to VM bindings and alert on new, unusual, or cross-tenant assignments.
Monitor OAuth2 token issuance from IMDS and tie each token back to the requesting VM and the human or automation principal that provisioned it.

Monitoring Recommendations

Forward STACKIT IaaS API access logs and IMDS access logs to a centralized analytics platform for cross-source correlation.
Alert on privileged service account usage originating from newly created or low-trust virtual machines.
Track changes to high-privileged service accounts and review attachment events on a daily cadence until remediation is confirmed.

How to Mitigate CVE-2026-39910

Immediate Actions Required

Review the Stackit Status Page and the VulnCheck Security Advisory to confirm the remediation status for your tenant.
Audit all service account attachments across the organization and remove bindings that cannot be tied to an approved workload.
Rotate OAuth2 credentials and refresh tokens associated with high-privileged service accounts that may have been exposed.

Patch Information

Remediation is delivered server-side by STACKIT as the affected API is a managed cloud service. No customer-side patch is required. Confirm that authorization checks are enforced on the servers service-accounts endpoint by validating attempts to attach a service account that the caller does not own are rejected.

Workarounds

Restrict creation of high-privileged service accounts and avoid scoping them at the organization root where not strictly required.
Apply least-privilege policies so that service accounts used by VMs carry only the permissions the workload needs.
Limit which identities can create or manage virtual machines, reducing the population of users who could stage an attachment attack.

bash

# Example: enumerate and review current service account attachments per server
# Replace placeholders with values appropriate to your environment
stackit server list --project-id <PROJECT_ID>
stackit server describe --server-id <SERVER_ID> --project-id <PROJECT_ID> \
  | grep -i service-account