CVE-2026-85514

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-85514
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85514.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-85514
Published
2026-09-04T12:45:09.992Z
Modified
2026-09-06T03:47:13.826776926Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
StackStorm st2 API Key auth.py privileges management
Details

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument apikeyapi.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Database specific 
{
    "cwe_ids": [
        "CWE-266",
        "CWE-269"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85514.json"
}
References

Affected packages

Git / github.com/stackstorm/st2

Affected ranges

Type
GIT
Repo
https://github.com/stackstorm/st2
Events
Introduced
04278e920c0111bfc1040a0ab6bf6d04cd2c05b5
Last affected
15e45d07d1b3a2b5330ef07a47dc258e2d56ded0
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "3.0"
        },
        {
            "last_affected": "3.0"
        },
        {
            "introduced": "3.1"
        },
        {
            "last_affected": "3.1"
        },
        {
            "introduced": "3.2"
        },
        {
            "last_affected": "3.2"
        },
        {
            "introduced": "3.3"
        },
        {
            "last_affected": "3.3"
        },
        {
            "introduced": "3.4"
        },
        {
            "last_affected": "3.4"
        },
        {
            "introduced": "3.5"
        },
        {
            "last_affected": "3.5"
        },
        {
            "introduced": "3.6"
        },
        {
            "last_affected": "3.6"
        },
        {
            "introduced": "3.7"
        },
        {
            "last_affected": "3.7"
        },
        {
            "introduced": "3.8"
        },
        {
            "last_affected": "3.8"
        },
        {
            "introduced": "3.9.0"
        },
        {
            "last_affected": "3.9.0"
        }
    ]
}

Affected versions

3.*
3.0
3.1
3.2
3.3
3.4
3.5
3.6
3.7
3.8
3.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85514.json"