Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-08 | 1 | Patch1 |
| 2026-06-13 | 1 | Disclosure1 |
🚨 CVE-2026-39910 — CVSS 9.8/10 ██████████ STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/OxO9b9INH9
Post summary
The tweet highlights a critical missing authorization check vulnerability with a CVSS score of 9.8/10 and urges patching, but provides no PoC, exploit code, or evidence of active exploitation.
☁️ CVE-2026-39910: STACKIT IaaS API's missing authorization check lets any low-privileged authenticated attacker escalate to full org compromise via service account attachment. Critical 9.3 CVSS. Check your exposure now. #CloudSecurity #PrivEsc https://secalerts.co/vulnerability/CVE-2026-39910 https://t.co/0aFErdx1Ts
Post summary
The post announces CVE-2026-39910—a critical failure in STACKIT’s IaaS API that allows low‑privileged attackers to fully compromise an organization via service account attachment, urging readers to check their exposure.