CVE-2026-85514

MEDIUM 6.3

StackStorm st2 API Key auth.py privileges management

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-269 CWE-266
Vendor	stackstorm
Product	st2
Published	Sep 4, 2026
Last Updated	Sep 4, 2026

Stay Ahead of the Next One

Get instant alerts for stackstorm st2

Be the first to know when new medium vulnerabilities affecting stackstorm st2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

StackStorm / st2

3.0 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/398679 vuldb.com: https://vuldb.com/vuln/398679/cti vuldb.com: https://vuldb.com/cve/CVE-2026-85514 vuldb.com: https://vuldb.com/submit/894917 github.com: https://github.com/StackStorm/st2/issues/6380 github.com: https://github.com/StackStorm/st2/

Credits

🔍 geochen (VulDB User) VulDB CNA Team