STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service account to a virtual machine they control without validation of their permission to use it, then query the Instance Metadata Service (IMDS) to retrieve an OAuth2 token for that service account and act with its privileges. The impact is confined to the attacker’s own project. The STACKIT Identity Provider enforces strict project matching between the target VM and the requested service account during token impersonation, so cross-project and cross-organization exploitation is not possible. Any further access is bounded by the IAM roles already assigned to the targeted service account.
References
Configurations
No configuration.
History
30 Oct 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) STACKIT IaaS API contains a missing authorization check in the PUT servers service-accounts endpoint. An authenticated, low-privileged attacker can attach an arbitrary service account to a virtual machine they control without validation of their permission to use it, then query the Instance Metadata Service (IMDS) to retrieve an OAuth2 token for that service account and act with its privileges. The impact is confined to the attacker’s own project. The STACKIT Identity Provider enforces strict project matching between the target VM and the requested service account during token impersonation, so cross-project and cross-organization exploitation is not possible. Any further access is bounded by the IAM roles already assigned to the targeted service account. |
Information
Published : 2026-06-08 17:16
Updated : 2026-10-30 17:17
NVD link : CVE-2026-39910
Mitre link : CVE-2026-39910
CVE.ORG link : CVE-2026-39910
JSON object : View
Products Affected
No product.
CWE
CWE-862
Missing Authorization