CVE-2026-85513
Deferred Deferred - Pending Action

Improper Privilege Management in StackStorm st2

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85513
EUVD
EUVD-2026-71087

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stackstorm st2 to 3.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper privilege management flaw in StackStorm st2 up to version 3.9.0. It exists in the function assert_user_is_admin_if_user_query_param_is_provided within the file st2api/st2api/controllers/v1/actionexecutions.py. The issue allows attackers to manipulate the User argument to gain unauthorized privileges. The attack can be executed remotely and an exploit is publicly available.

Detection Guidance

To detect this vulnerability, inspect StackStorm st2 API logs for requests containing a 'user' field in the JSON body to endpoints like /v1/actionexecutions. Check for unusual user impersonation attempts or unauthorized secret access patterns in audit trails. Use commands like grep to search logs for 'user' parameter misuse: grep -r '"user"' /var/log/st2/ or journalctl -u st2api --grep='user'. Monitor for API responses containing decrypted secrets before execution completion.

Impact Analysis

This vulnerability allows authenticated users to impersonate other users, including administrators, and exfiltrate cross-account secrets. Attackers can decrypt and steal user-scoped secrets such as API keys, passwords, and OAuth tokens by including specific Jinja templates in action parameters. The decrypted secrets are returned in API responses, enabling immediate access to plaintext credentials.

Mitigation Strategies

Immediately upgrade StackStorm st2 to a version beyond 3.9.0 if available. If upgrading is not possible, disable the execution API endpoint or restrict access to authenticated users with strict RBAC policies. Review and revoke any exposed secrets, especially those accessible via user-scoped KV items. Monitor for suspicious API activity and block external access to the st2api service if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85513. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart