Is CVE-2026-85514 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85514 being exploited in the wild.

How severe is CVE-2026-85514?

Medium severity, with a CVSS score of 6.3, published 4 September 2026.

Is there a fix for CVE-2026-85514?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-85514 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-85514?

Check whether you run StackStorm St2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85514: StackStorm st2 privilege escalation via API key creation

CVE-2026-85514 · Severity: medium · CVSS 6.3 · Published 2026-09-04

StackStorm st2 is an event-driven automation platform used for incident response and DevOps workflows. A vulnerability in the API key handler allows any user with permission to create API keys to bind those keys to arbitrary users, including administrators, and thus gain their privileges. An attacker with limited permissions can escalate to full administrative access to the StackStorm API.

Technologies: StackStorm St2. Vendors: StackStorm.

Quick answers

Is CVE-2026-85514 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85514 being exploited in the wild.
How severe is CVE-2026-85514?: Medium severity, with a CVSS score of 6.3, published 4 September 2026.
Which products and versions are affected?: StackStorm St2 up to 3.9.0.
Is there a fix for CVE-2026-85514?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-85514 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-85514?: Check whether you run StackStorm St2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an improper authorization/privilege management flaw in the API Key Handler (st2api/controllers/v1/auth.py). When a user creates an API key, the controller accepts the user field from the request body without validating that the requester is authorized to act on behalf of that user. Unlike sibling controllers (rules, executions), it does not call assert_user_is_admin_if_user_query_param_is_provided to enforce this constraint. A remote attacker with the api_key_create permission can craft a request specifying an arbitrary user (e.g., st2admin) and create an API key bound to that user, then use the key to authenticate as that user. This affects StackStorm st2 up to version 3.9.0 when the enterprise RBAC backend is enabled. The vulnerability is network-accessible and requires only the api_key_create permission; no fix or patch information is currently available.

Affected products

StackStorm st2 up to 3.9.0

Timeline

2026-06-20: disclosed: Issue #6380 opened on GitHub
2026-09-04: advisory: CVE-2026-85514 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.