CVE-2026-85514— StackStorm st2 API Key auth.py privileges management
Quick assessment
Affected
StackStorm st2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 StackStorm st2 3.9.0 及更早版本中发现了一个安全漏洞。受影响的是组件“API Key Handler”中文件 的某个未知函数。对参数 的不当处理会导致权限管理不当。该攻击可从远程发起。该漏洞已被公开披露，且可能被利用。项目方已通过 issue 报告提前知晓该问题，但尚未作出回应。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1550 · Use Alternate Authentication MaterialAffected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| StackStorm | st2 | 3.0 |
affected |
3.1 |
affected | ||
3.2 |
affected | ||
3.3 |
affected | ||
3.4 |
affected | ||
3.5 |
affected | ||
3.6 |
affected | ||
3.7 |
affected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-85514
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
StackStorm st2 API Key auth.py privileges management
Source: CVE Program / CVE List V5
Vulnerability Description
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| StackStorm | st2 | 3.0 |
cpe:2.3:a:stackstorm:st2:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-85514
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-85514
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-85514 (1)
Vendor Pages for CVE-2026-85514 (1)
-
🔗 GitHub - StackStorm/st2: StackStorm (aka "IFTTT for Ops") is event-driven automation for auto-remediation, incident responses, troubleshooting, deployments, and more for DevOps and SREs. Includes rules engine, workflow, 160 integration packs with 6000+ actions (see https://exchange.stackstorm.org) and ChatOps. Installer at https://docs.stackstorm.com/install/index.html · GitHub Read full article product
Other References for CVE-2026-85514 (3)
-
🔗 CVE-2026-85514 in st2 third-party-advisory
-
🔗 CVE-2026-85514 StackStorm st2 API Key auth.py privileges management Read full article vdb-entry technical-description
-
🔗 Submit #894917: StackStorm st2 3.9.0 Improper Privilege Management Read full article third-party-advisory
IV. Related Vulnerabilities
Same weakness: CWE-269
-
CVE-2026-86153
Tenda CP3 Redirect.cpp SetRedirectEnable privileges manageme -
CVE-2026-86195
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation vi -
CVE-2026-81543
Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Autho -
CVE-2026-85513
StackStorm st2 NoOp RBAC backend actionexecutions.py privile -
CVE-2026-15354
ACPT (Premium) <= 2.0.66 - Unauthenticated Privilege Escalat
V. Comments for CVE-2026-85514
No comments yet