CVE-2026-85514: StackStorm st2 Privilege Escalation Flaw

CVE-2026-85514 Overview

CVE-2026-85514 affects StackStorm st2 versions up to 3.9.0. The flaw resides in the API Key Handler component, specifically in the st2api/st2api/controllers/v1/auth.py file. Manipulation of the api_key_api.user argument leads to improper privilege management [CWE-266]. A remote attacker with low privileges can abuse this weakness to obtain unintended access. The exploit has been publicly disclosed, increasing the risk of opportunistic abuse. StackStorm was notified through an issue report but has not yet responded at the time of publication.

Critical Impact

Authenticated remote attackers can manipulate the api_key_api.user parameter to escalate privileges within StackStorm st2 deployments, potentially executing automation workflows under another user's identity.

Affected Products

• StackStorm st2 versions up to and including 3.9.0
• Deployments exposing the st2api service to networked clients
• Automation pipelines relying on API key-based authentication in st2

Discovery Timeline

• 2026-09-04 - CVE-2026-85514 published to NVD
• 2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-85514

Vulnerability Analysis

StackStorm is an event-driven automation platform used for workflow orchestration and remediation. The vulnerable code path lives in the API Key Handler within st2api/st2api/controllers/v1/auth.py. The controller accepts an api_key_api.user argument during API key creation or association without adequately verifying that the requester is authorized to bind an API key to that user. As a result, a low-privileged authenticated caller can influence which user identity an API key represents. Subsequent use of that key allows the attacker to act with the privileges of the specified user, breaking the boundary between distinct st2 accounts.

Root Cause

The underlying weakness is improper privilege management [CWE-266]. The handler treats the user field as caller-controlled input rather than deriving the identity from the authenticated session. Because StackStorm executes automations, sensor triggers, and remediation actions on behalf of the API key owner, incorrect user attribution translates directly into privilege escalation. No integrity check enforces that only administrators can assign an API key to an arbitrary user.

Attack Vector

The attack is executed remotely over the network against the st2api endpoint. The attacker must hold valid low-privileged credentials. By submitting a crafted API key creation or update request that includes another user's identity in api_key_api.user, the attacker obtains a key associated with that target user. The key can then be used to invoke actions, workflows, or rules with the target's permissions. Public disclosure of the issue in GitHub Issue #6380 and the associated VulDB entry raises the likelihood of exploitation attempts.

No verified proof-of-concept code has been published. See the referenced advisories for technical detail.

Detection Methods for CVE-2026-85514

Indicators of Compromise

• API key creation requests to /v1/apikeys where the user field differs from the authenticated caller
• Sudden appearance of new API keys tied to administrative or service accounts
• Automation executions initiated by users whose interactive login history shows no corresponding session
• Unexpected privilege escalation events in st2 audit logs following API key creation activity

Detection Strategies

• Compare the authenticated principal in st2api access logs against the user value in API key create or update payloads and alert on mismatches.
• Baseline normal API key issuance patterns per user and flag deviations, especially bursts of key creation.
• Correlate newly issued API keys with subsequent high-privilege action executions in StackStorm history.

Monitoring Recommendations

• Forward st2api and st2auth logs to a centralized analytics platform for retention and correlation.
• Enable verbose auditing on API key endpoints and retain events for at least 90 days.
• Monitor GitHub Issue #6380 and vendor channels for patch availability and updated indicators.

How to Mitigate CVE-2026-85514

Immediate Actions Required

• Inventory all StackStorm st2 installations at version 3.9.0 or earlier and restrict network exposure of the st2api service.
• Revoke and rotate existing API keys, then reissue them under strict administrative control.
• Enforce least privilege on st2 user accounts to reduce the blast radius of key misuse.
• Review recent API key creation events for unauthorized user assignments and revoke suspicious keys.

Patch Information

No vendor patch has been released at the time of writing. The project was notified through an issue report but has not yet responded. Track GitHub Issue #6380 and the StackStorm repository for remediation updates.

Workarounds

• Restrict access to the st2api endpoint to trusted management networks using firewall or reverse-proxy rules.
• Limit API key creation privileges to administrator roles only and disable self-service key issuance for low-privileged users.
• Add an upstream authorization layer that rejects API key creation requests where the payload user does not match the authenticated principal.
• Increase logging granularity on auth.py handlers and alert on any use of the api_key_api.user field by non-administrators.