# CVE-2026-85513: StackStorm st2 privilege escalation in action execution

Source: https://junglewise.ai/threats/cve-2026-85513-stackstorm-st2-privilege-escalation-in-action-execution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85513 · Severity: medium · CVSS 6.3 · Published 2026-09-04

StackStorm st2 is an automation platform that executes actions and workflows in response to events. A privilege escalation vulnerability allows any authenticated user to impersonate other users—including administrators—when submitting action execution requests, enabling them to access secrets and execute commands with elevated privileges. This affects the default configuration and can be exploited to exfiltrate sensitive credentials and compromise infrastructure.

Technologies: [StackStorm St2](https://junglewise.ai/threats/technologies/st2). Vendors: [StackStorm](https://junglewise.ai/threats/vendors/stackstorm).

## Quick answers

**Is CVE-2026-85513 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85513 being exploited in the wild.

**How severe is CVE-2026-85513?** Medium severity, with a CVSS score of 6.3, published 4 September 2026.

**Which products and versions are affected?** StackStorm St2 up to 3.9.0.

**Is there a fix for CVE-2026-85513?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85513 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-85513?** Check whether you run StackStorm St2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the `assert_user_is_admin_if_user_query_param_is_provided` function in st2api/st2api/controllers/v1/actionexecutions.py. The function is called without the `require_rbac=True` flag, causing the NoOp RBAC backend (active by default when RBAC is disabled) to skip privilege checks entirely. An authenticated attacker can supply a `user` field in the POST /api/v1/executions request body to run actions under any user's identity, including administrators. By embedding Jinja templates referencing user-scoped KV store secrets (e.g., `{{ st2kv.user.<key> | decrypt_kv }}`), the attacker can decrypt and exfiltrate secrets belonging to the impersonated user. The decrypted values are returned immediately in the API response and can also be passed to the shell runner. This affects all StackStorm installations regardless of RBAC configuration and does not require special permissions to exploit.

## Affected products

- StackStorm st2 up to 3.9.0

## Timeline

- 2026-09-04: disclosed: CVE-2026-85513 published on NVD
- 2026-05-25: other: Vulnerability reported to StackStorm via email; no response from project

## References

- [https://github.com/StackStorm/st2/](https://github.com/StackStorm/st2/)
- [https://github.com/StackStorm/st2/issues/6379](https://github.com/StackStorm/st2/issues/6379)

## Related threats

- [StackStorm st2 privilege escalation via API key creation](https://junglewise.ai/threats/cve-2026-85514-stackstorm-st2-privilege-escalation-via-api-key-creation)
- [StackStorm st2 infinite loop in Unicode logging](https://junglewise.ai/threats/cve-2021-28667-stackstorm-st2-infinite-loop-in-unicode-logging)