CVE-2026-85513: StackStorm st2 Privilege Escalation Flaw

CVE-2026-85513 Overview

CVE-2026-85513 is an improper privilege management weakness [CWE-266] in StackStorm st2 versions up to 3.9.0. The flaw resides in the assert_user_is_admin_if_user_query_param_is_provided function within st2api/st2api/controllers/v1/actionexecutions.py, part of the NoOp Role-Based Access Control (RBAC) backend. An authenticated remote attacker can manipulate the user argument to bypass administrative checks and act on behalf of other users. Unlike the prior related advisory CVE-2022-44009, this issue does not depend on Jinja RBAC and affects default installations where RBAC is disabled. A public exploit is available.

Critical Impact
Authenticated remote users can impersonate other accounts via the user query parameter, enabling privilege management bypass in default StackStorm deployments where RBAC is not enabled.

Affected Products

StackStorm st2 versions up to and including 3.9.0
Default installations with RBAC disabled (NoOp RBAC backend)
Deployments exposing the st2api action executions endpoint

Discovery Timeline

2026-09-04 - CVE-2026-85513 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85513

Vulnerability Analysis

StackStorm st2 is an event-driven automation platform. The st2api service exposes REST endpoints that accept a user query parameter allowing administrators to submit executions on behalf of other users. The assert_user_is_admin_if_user_query_param_is_provided function is intended to restrict this capability to admin users. In the NoOp RBAC backend, which is the default when RBAC is disabled, the admin check does not correctly enforce authorization. As a result, any authenticated user can supply an arbitrary value for the user parameter and have actions attributed to or executed under that identity.

The weakness is categorized under CWE-266 (Incorrect Privilege Assignment). Exploitation requires low privileges and no user interaction, and the attack is delivered over the network against the st2api service.

Root Cause

The root cause lies in the NoOp RBAC backend's permissive handling of the admin assertion. When RBAC is disabled, the backend returns success for authorization checks without validating whether the caller is truly privileged to override the user argument. The check assert_user_is_admin_if_user_query_param_is_provided therefore fails open, permitting the user parameter to be honored for any authenticated caller.

Attack Vector

An attacker with valid st2 credentials sends an HTTP request to the action executions API endpoint including the user query parameter set to a target account. Because the NoOp backend does not enforce the admin check, st2api accepts the impersonated identity and creates or queries executions in the target user's context. This is distinct from CVE-2022-44009, which required Jinja RBAC to be in use. See the StackStorm Issue #6379 and the VulDB CVE-2026-85513 entry for technical details.

No verified proof-of-concept code is included in this advisory. Refer to the linked StackStorm issue and VulDB references for reproduction details.

Detection Methods for CVE-2026-85513

Indicators of Compromise

HTTP requests to /v1/executions or related st2api endpoints that include a ?user= query parameter from non-admin accounts.
Action executions in st2 audit logs attributed to users who did not initiate the request.
Unexpected execution history entries associated with privileged service accounts.

Detection Strategies

Instrument the st2api reverse proxy or ingress to log full query strings and correlate user parameter values with the authenticated principal.
Alert when the authenticated API token owner differs from the value supplied in the user query parameter, unless the token belongs to a designated admin.
Review StackStorm audit and history streams for executions where the context.user field does not match the requesting API key or token.

Monitoring Recommendations

Forward st2api and st2auth logs to a centralized logging or SIEM platform for correlation and long-term retention.
Monitor for anomalous spikes in action executions initiated by low-privilege accounts against sensitive workflows.
Track calls to the action executions controller and baseline normal user parameter usage per API client.

How to Mitigate CVE-2026-85513

Immediate Actions Required

Restrict network exposure of the st2api service to trusted management networks only.
Enable a full RBAC backend in StackStorm rather than relying on the default NoOp backend.
Rotate and audit all st2 API keys and tokens, removing unused or overly permissive credentials.
Review recent action execution history for entries where the user parameter was supplied by non-admin callers.

Patch Information

At the time of publication, the StackStorm project had been notified through an issue report but has not released an official patch. Track the StackStorm GitHub repository and Issue #6379 for a fixed release beyond version 3.9.0.

Workarounds

Deploy an authenticating reverse proxy in front of st2api that strips or validates the user query parameter for non-admin callers.
Enable RBAC with an enforcing backend so that assert_user_is_admin_if_user_query_param_is_provided performs a real authorization check.
Limit issuance of st2 API keys to service accounts with least-privilege scopes and audit their usage.

bash

# Configuration example: enable RBAC in st2.conf to replace the NoOp backend
[rbac]
enable = True
backend = default