CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-39910 — STACKIT IaaS API contains a missing authorization check vulnerability that allow...

·Source: NIST NVD

Updated:

Executive Summary

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadat

Analysis

STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment. CVSS Score: 9.8. Published: 2026-06-08T17:16:42.613.

Indicators of Compromise (1)

CVE (1)
CVE-2026-39910
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 8, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerability

Canada's Koho hits unicorn status and targets banking license

Canadian fintech Koho has raised C$130 million at a C$1.33 billion valuation, providing it with the initial capital base it needs in its pursuit of a federal banking license.

Finextra
MEDIUMVulnerability

Digital Asset raises $355m to make Canton the onchain infrastructure for capital markets

A host of financial services giants, including BNP Paribas, Coinbase and HSBC, have joined a $355 million funding round for Digital Asset, the firm behind the Canton Network public, permissionless blockchain purpose-built for institutional finance.

Finextra
MEDIUMVulnerability

Japanese energy firm loses drive with data of 10.9 million clients

Kyushu Electric Power Co., Inc. has disclosed a physical security incident that affects private data of more than 10 million customers. [...]

BleepingComputer