Executive brief
StackStorm st2 is an event-driven automation platform used for incident response and DevOps workflows. A vulnerability in the API key handler allows any user with permission to create API keys to bind those keys to arbitrary users, including administrators, and thus gain their privileges. An attacker with limited permissions can escalate to full administrative access to the StackStorm API.
Technical details
The vulnerability is an improper authorization/privilege management flaw in the API Key Handler (st2api/controllers/v1/auth.py). When a user creates an API key, the controller accepts the user field from the request body without validating that the requester is authorized to act on behalf of that user. Unlike sibling controllers (rules, executions), it does not call assert_user_is_admin_if_user_query_param_is_provided to enforce this constraint. A remote attacker with the api_key_create permission can craft a request specifying an arbitrary user (e.g., st2admin) and create an API key bound to that user, then use the key to authenticate as that user. This affects StackStorm st2 up to version 3.9.0 when the enterprise RBAC backend is enabled. The vulnerability is network-accessible and requires only the api_key_create permission; no fix or patch information is currently available.
Affected products
- StackStorm st2 up to 3.9.0
Timeline
- 2026-06-20: disclosed: Issue #6380 opened on GitHub
- 2026-09-04: advisory: CVE-2026-85514 published on NVD