CVE-2026-85514

MediumCVSS 6.3

Published: 04/09/2026(UTC)Updated: 04/09/2026(UTC)Translated: 04/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

A vulnerability has been detected in StackStorm st2 up to version 3.9.0 in the API Key Handler component in auth.py. Manipulation of the api_key_api.user argument leads to improper privilege management. The attack can be performed remotely, and the exploit has been publicly disclosed.

Risk Assessment

Risk of unauthorized access and privilege escalation in StackStorm, potentially leading to control over automation and data.

Recommendation

Immediately update StackStorm to the latest available version if possible, and monitor public information for patches. Restrict API access to trusted networks only.

Other vulnerabilities in StackStorm

CVE-2026-85513Medium
A vulnerability in StackStorm st2 up to version 3.9.0 affects the function assert_user_is_admin_if_user_query_param_is_provided in actionexecutions.py, in the NoOp RBAC component. Manipulation of the User argument leads to improper privilege management. The attack can be performed remotely, and the exploit is publicly available. The issue affects default installations with RBAC disabled and does not require Jinja RBAC.

Original NVD description (English source)

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS