CVE-2026-85514 | StackStorm st2 up to 3.9.0 API Key auth.py api_key_api.user privileges management (Issue 6380)

September 4, 2026 Yanac

A vulnerability classified as critical was found in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management.

This vulnerability is listed as CVE-2026-85514. The attack may be performed from remote. In addition, an exploit is available.

The project was informed of the problem early through an issue report but has not responded yet.VulDB Recent EntriesRead More