CVE-2026-85514 in st2
Summary
by MITRE • 09/04/2026
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified in StackStorm versions up to 3.9.0 represents a critical failure in access control mechanisms within the API Key Handler component, specifically located in the st2api/st2api/controllers/v1/auth.py module. This flaw stems from improper privilege management resulting from the manipulation of the api_key_api.user argument during authentication and authorization processes. The core technical issue involves an insecure direct object reference or a logic error where the system fails to properly validate that the user associated with the provided API key possesses the necessary permissions for the requested action. By exploiting this weakness, an attacker can bypass intended security restrictions, effectively elevating their privileges within the StackStorm environment without requiring valid credentials for higher-level operations. This type of vulnerability is classically categorized under CWE-269 Improper Privilege Management and often intersects with CWE-862 Missing Authorization checks in application logic.
The operational impact of this vulnerability is severe due to its remote exploitability, allowing attackers to interact with the system over a network without physical or local access requirements. Since StackStorm serves as an automation platform for DevOps tasks, compromising authentication controls can lead to unauthorized execution of workflows, modification of infrastructure configurations, and potential data exfiltration. The fact that the exploit has been disclosed publicly significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage known proof-of-concept code to target vulnerable instances. This public disclosure creates an immediate window of exposure where organizations running affected versions are susceptible to targeted attacks aimed at gaining persistent access or disrupting critical automation pipelines.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Initial Access and Privilege Escalation. Specifically, it relates to T1078 Valid Accounts, as attackers can use stolen or manipulated API keys to authenticate legitimately while performing unauthorized actions. Furthermore, the lack of proper authorization checks corresponds to T1548 Abuse Elevation Control Mechanism, where the attacker abuses system mechanisms designed to control privilege levels. The absence of a vendor response despite early notification through an issue report exacerbates the risk, leaving administrators without official patches or guidance for immediate remediation. This delay forces security teams to rely on community-driven workarounds and increased monitoring rather than definitive software updates.
Mitigation strategies must focus on both immediate containment and long-term architectural improvements. Organizations should immediately audit their StackStorm deployments to identify any instances running version 3.9.0 or earlier, prioritizing those exposed to untrusted networks for potential isolation or access restriction via network security groups until an upgrade is feasible. Implementing strict API key rotation policies can limit the window of opportunity if a specific key has been compromised. Additionally, deploying Web Application Firewalls with rulesets tuned to detect anomalous authentication patterns related to StackStorm endpoints may provide a layer of defense against exploitation attempts. Long-term resolution requires upgrading to a patched version once released by the vendor and enforcing principle of least privilege in all API key configurations to minimize the blast radius of any future access control failures.