stackstorm st2 vulnerabilities

Latest stackstorm st2 CVEs

Newest publication first

1. CVE-2026-85514 StackStorm st2 API Key auth.py privileges management

   Published 2026-09-04

   Medium·CVSS 5.3 EPSS 0.37%

   A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management....

2. CVE-2026-85513 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

   Published 2026-09-04

   Medium·CVSS 5.3 EPSS 0.43%

   A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument Us...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.