CVE-2026-85513

MediumCVSS 6.3

Published: 04/09/2026(UTC)Updated: 08/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.25%

16th percentile - higher than 16% of all known CVEs

Summary

A vulnerability in StackStorm st2 up to version 3.9.0 affects the function assert_user_is_admin_if_user_query_param_is_provided in actionexecutions.py, in the NoOp RBAC component. Manipulation of the User argument leads to improper privilege management. The attack can be performed remotely, and the exploit is publicly available. The issue affects default installations with RBAC disabled and does not require Jinja RBAC.

Risk Assessment

Risk of unauthorized access to action execution operations, potentially leading to privilege escalation and system integrity compromise.

Recommendation

Update StackStorm to a patched version or enable and configure RBAC if possible. Restrict API access and monitor logs for unusual requests.

Other vulnerabilities in StackStorm

CVE-2026-85514Medium
A vulnerability has been detected in StackStorm st2 up to version 3.9.0 in the API Key Handler component in auth.py. Manipulation of the api_key_api.user argument leads to improper privilege management. The attack can be performed remotely, and the exploit has been publicly disclosed.

Original NVD description (English source)

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS