Executive brief
StackStorm st2 is an automation platform that executes actions and workflows in response to events. A privilege escalation vulnerability allows any authenticated user to impersonate other users—including administrators—when submitting action execution requests, enabling them to access secrets and execute commands with elevated privileges. This affects the default configuration and can be exploited to exfiltrate sensitive credentials and compromise infrastructure.
Technical details
The vulnerability is an authentication bypass in the `assert_user_is_admin_if_user_query_param_is_provided` function in st2api/st2api/controllers/v1/actionexecutions.py. The function is called without the `require_rbac=True` flag, causing the NoOp RBAC backend (active by default when RBAC is disabled) to skip privilege checks entirely. An authenticated attacker can supply a `user` field in the POST /api/v1/executions request body to run actions under any user's identity, including administrators. By embedding Jinja templates referencing user-scoped KV store secrets (e.g., `{{ st2kv.user.<key> | decrypt_kv }}`), the attacker can decrypt and exfiltrate secrets belonging to the impersonated user. The decrypted values are returned immediately in the API response and can also be passed to the shell runner. This affects all StackStorm installations regardless of RBAC configuration and does not require special permissions to exploit.
Affected products
- StackStorm st2 up to 3.9.0
Timeline
- 2026-09-04: disclosed: CVE-2026-85513 published on NVD
- 2026-05-25: other: Vulnerability reported to StackStorm via email; no response from project