CVE-2026-85514
Deferred Deferred - Pending Action

Improper Privilege Management in StackStorm st2 API Key Handler

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulDB

Description
A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85514
EUVD
EUVD-2026-71088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
stackstorm st2 to 3.9.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a privilege escalation vulnerability in StackStorm st2 versions up to 3.9.0. It allows a non-admin user with the api_key_create permission to create an API key bound to any user, including administrators. The API key inherits the permissions of the target user, granting the attacker full administrative access. The issue occurs because the API key controller does not validate if the requesting user is authorized to impersonate the specified target user.

Detection Guidance

To detect this vulnerability, check StackStorm logs for API key creation events where a non-admin user creates a key bound to an admin account like st2admin. Review the st2api/st2api/controllers/v1/auth.py file for improper privilege checks during API key creation. Use commands like grep to search for suspicious API key creation logs or inspect RBAC role assignments for unauthorized api_key_create permissions.

Impact Analysis

An attacker could exploit this to gain full administrative privileges in your StackStorm installation. This includes managing RBAC roles, accessing or decrypting sensitive data, executing actions as an admin, and modifying system configurations. The attack can be performed remotely and may go undetected due to incorrect audit logs attributing actions to the impersonated admin user.

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, violating compliance requirements such as GDPR and HIPAA. It may result in data breaches, improper access controls, and lack of audit trail integrity, all of which are critical for maintaining regulatory compliance.

Mitigation Strategies

Immediately disable the api_key_create permission for non-admin users in RBAC configurations. Update StackStorm to a patched version if available. Monitor API key creation logs for unauthorized admin-bound key generation. Temporarily revoke all existing API keys and reissue them after applying fixes to ensure no compromised keys remain active.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85514. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart