Security bulletin

Security bulletins inform you about vulnerabilities, remediation steps, and security updates that affect STACKIT platform services.

STACKIT prioritizes the security and reliability of all cloud infrastructure services. The security bulletin hub provides transparent information regarding security advisories, vulnerability disclosures, and mitigation guidance across STACKIT platform services and products.

Purpose of security bulletins

Security bulletins provide clear, timely guidance when vulnerabilities or security issues arise. Each advisory includes:

• Impact analysis: Identification of affected services, components, and configurations.
• Severity assessment: Standardized severity rating based on Common Vulnerability Scoring System (CVSS) metrics.
• Mitigation and remediation: Clear instructions on required actions, patches, or configuration changes.
• Timeline and status: Chronological records of discovery, disclosure, and patch availability.

Severity classifications

STACKIT evaluates the severity of vulnerabilities using the Common Vulnerability Scoring System (CVSS). STACKIT prioritizes CVSS v4.0 scoring whenever available (falling back to CVSS v3.1 when v4.0 scores are not published). This standardized approach helps you prioritize updates and required response actions:

Severity	CVSS score	Definition
Critical	9.0–10.0	Vulnerabilities that allow attackers to run code remotely or cause complete system compromise without user interaction. Require immediate mitigation.
High	7.0–8.9	Vulnerabilities that lead to privilege escalation, data exfiltration, or service disruption under specific conditions. Require prioritized remediation.
Medium	4.0–6.9	Vulnerabilities that require specific preconditions, elevated privileges, or complex exploitation techniques.
Low	0.1–3.9	Vulnerabilities with minimal direct security impact or high exploitation complexity.

Report a vulnerability

STACKIT values collaboration with security researchers, customers, and partners. If you identify a potential security issue in STACKIT services:

1. Submit a report: Send detailed findings to the STACKIT security team through the STACKIT Help Center or by email to cybersecurity@stackit.cloud.
2. Include details: Provide step-by-step reproduction instructions, affected endpoints or components, and proof-of-concept material.
3. Practice coordinated disclosure: Refrain from disclosing findings publicly until the STACKIT security team investigates and deploys a fix.

Published advisories

The following table lists published security advisories and vulnerability notices for STACKIT platform services:

Advisory ID	Title	Published date	Severity	Affected services
STACKIT-2026-001	Multiple Vulnerabilities in MariaDB	2026-10-22	High / Critical	STACKIT MariaDB / MariaDB On-Premises