EUVD-2026-35128
GHSA-p35h-r99r-9fcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible API requiring low-privilege auth; scope changes as tenant boundary is crossed to reach organization-wide resources; no availability impact explicitly described.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
10DescriptionCVE.org
STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organization compromise by attaching arbitrary service accounts to virtual machines they control. Attackers can exploit the unvalidated PUT servers service-accounts endpoint to attach high-privileged service accounts and query the Instance Metadata Service to retrieve OAuth2 tokens, bypassing tenant boundaries and gaining unauthorized control over the entire organization environment.
AnalysisAI
Privilege escalation in STACKIT IaaS API enables any authenticated low-privileged tenant to compromise an entire organization by exploiting a missing authorization check on the PUT servers/service-accounts endpoint. All versions prior to 2026-05-28 permit a tenant to attach arbitrary high-privileged service accounts to virtual machines they control, after which the Instance Metadata Service (IMDS) can be queried to retrieve OAuth2 tokens belonging to those accounts, crossing tenant isolation boundaries to achieve full organizational control. No active exploitation has been confirmed (absent from CISA KEV, EPSS at 0.04%), but SSVC rates the attack automatable with total technical impact, making this a high internal priority for all STACKIT IaaS customers.
Technical ContextAI
STACKIT IaaS API is a cloud infrastructure management API offered by STACKIT, a European cloud provider. The flaw is classified as CWE-862 (Missing Authorization): the PUT endpoint responsible for attaching service accounts to server (VM) resources does not validate whether the requesting tenant is the authorized owner of the specified service account resource. In cloud IaaS environments, service accounts are IAM identity constructs whose OAuth2 credentials are made available to attached VMs via the Instance Metadata Service - a link-local HTTP endpoint (typically 169.254.169.254) accessible from within any running VM. By attaching an arbitrary high-privileged service account from another tenant or a privileged organizational role to an attacker-controlled VM, the attacker can then query IMDS to harvest a valid OAuth2 bearer token and impersonate that identity across the entire STACKIT organization. The affected CPE is cpe:2.3:a:stackit:iaas_api:*:*:*:*:*:*:*:*, encompassing all IaaS API builds before the 2026-05-28 remediation date.
RemediationAI
Apply the vendor-released patch made available as of 2026-05-28 per EUVD-2026-35128; organizations should confirm their STACKIT IaaS API build date is on or after that date. The STACKIT status page at https://status.stackit.cloud may carry additional operational guidance. As a compensating control where immediate patching is not feasible, restrict API access to the PUT servers/service-accounts endpoint at the network or API gateway layer to only highly privileged, explicitly authorized principals - note this may break legitimate automation that relies on dynamic service account attachment. Additionally, audit all current service account-to-VM attachment records across the organization and revoke any unauthorized associations; cross-reference OAuth2 token issuance logs from IMDS for anomalous cross-tenant token requests as an indicator of prior exploitation. Rotating credentials for all high-privileged service accounts is advisable if exploitation cannot be ruled out.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today