CVE-2026-39910 is a critical vulnerability in the STACKIT IaaS API caused by a missing authorization check on the PUT servers service-accounts endpoint. This allows authenticated attackers with low privileges to escalate their access by attaching arbitrary, high-privileged service accounts to virtual machines they control. By doing so, attackers can query the Instance Metadata Service to obtain OAuth2 tokens, effectively bypassing tenant isolation and gaining unauthorized control over the entire organization environment. The vulnerability has a CVSS 4.0 base score of 9.3, indicating high impact and exploitability. No patch or official remediation guidance is currently available, and the affected versions are not specified.

Successful exploitation results in full organization compromise by allowing attackers to escalate privileges from low-privileged authenticated users to high-privileged service accounts. This leads to unauthorized access and control over the entire organization environment, violating tenant boundaries and potentially exposing sensitive data and resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected API endpoints to trusted users only and monitor for suspicious activity related to service account attachments. Avoid using the vulnerable PUT servers service-accounts endpoint where possible.