Privilege escalation in Stackstorm St2
CVE-2026-85513
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (35.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 35.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.004 · change: +0.002
Affected products
- Stackstorm St2 — versions 3.0, 3.1, 3.2
Weakness classification (CWE)
References
- github.com/StackStorm/st2/ (product)
- github.com/StackStorm/st2/issues/6379 (issue-tracking, exploit)
- vuldb.com/cve/CVE-2026-85513 (third-party-advisory)
- vuldb.com/submit/894916 (third-party-advisory)
- vuldb.com/vuln/398678 (technical-description, vdb-entry)
- vuldb.com/vuln/398678/cti (signature, permissions-required)
Frequently asked questions
- What is CVE-2026-85513?
- CVE-2026-85513 is a medium-severity vulnerability in Stackstorm St2, classified under Incorrect Privilege Assignment. CVSS score: 6.3/10. Published 2026-09-04.
- How severe is CVE-2026-85513?
- Medium severity. CVSS v3 base score is 6.3 out of 10.