PatchSiren cyber security CVE debrief
CVE-2026-39910 STACKIT CVE debrief
CVE-2026-39910 is a critical vulnerability in STACKIT IaaS API that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise. The vulnerability is caused by a missing authorization check in the API, which allows attackers to attach arbitrary service accounts to virtual machines they control. This can be done by exploiting the unvalidated PUT servers service-accounts endpoint. Attackers can then query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.
- Vendor
- STACKIT
- Product
- IaaS API
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-08
- Original CVE updated
- 2026-06-09
- Advisory published
- 2026-06-08
- Advisory updated
- 2026-06-09
Who should care
Administrators and users of STACKIT IaaS API should be aware of this vulnerability and take immediate action to patch their systems.
Technical summary
The vulnerability has a CVSS score of 9.3 and is classified as CRITICAL. The CVSS vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
high
Recommended defensive actions
- Apply the patch as soon as possible to prevent exploitation.
- Review and update access controls to ensure that only authorized users have access to the API.
- Monitor the API for suspicious activity and implement additional security measures to detect and prevent attacks.
Evidence notes
The vulnerability was reported by [email protected] and is related to CWE-862.
Official resources
CVE-2026-39910 was published on [cvePublishedAt] and modified on [cveModifiedAt].