Iaas Api
Monthly
Privilege escalation in STACKIT IaaS API enables any authenticated low-privileged tenant to compromise an entire organization by exploiting a missing authorization check on the PUT servers/service-accounts endpoint. All versions prior to 2026-05-28 permit a tenant to attach arbitrary high-privileged service accounts to virtual machines they control, after which the Instance Metadata Service (IMDS) can be queried to retrieve OAuth2 tokens belonging to those accounts, crossing tenant isolation boundaries to achieve full organizational control. No active exploitation has been confirmed (absent from CISA KEV, EPSS at 0.04%), but SSVC rates the attack automatable with total technical impact, making this a high internal priority for all STACKIT IaaS customers.
Privilege escalation in STACKIT IaaS API enables any authenticated low-privileged tenant to compromise an entire organization by exploiting a missing authorization check on the PUT servers/service-accounts endpoint. All versions prior to 2026-05-28 permit a tenant to attach arbitrary high-privileged service accounts to virtual machines they control, after which the Instance Metadata Service (IMDS) can be queried to retrieve OAuth2 tokens belonging to those accounts, crossing tenant isolation boundaries to achieve full organizational control. No active exploitation has been confirmed (absent from CISA KEV, EPSS at 0.04%), but SSVC rates the attack automatable with total technical impact, making this a high internal priority for all STACKIT IaaS customers.