CVE-2026-85514CWE-266CWE-269privilege-escalation

CVE-2026-85514

Medium · published September 4, 2026

CVSS v3.1
6.3
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00366 · 29.2th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-269 · Improper Privilege Management
Published
2026-09-04T17:20Z
References (7)
https://github.com/StackStorm/st2/ · [email protected]https://github.com/StackStorm/st2/issues/6380 · [email protected]https://vuldb.com/cve/CVE-2026-85514 · [email protected]https://vuldb.com/submit/894917 · [email protected]https://vuldb.com/vuln/398679 · [email protected]https://vuldb.com/vuln/398679/cti · [email protected]https://github.com/StackStorm/st2/issues/6380 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 06 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 04 SEP 12:45Z
    StackStorm st2 API Key auth.py privileges management
    cvelistv5