TI-2026-58675 CVE-2026-85514 · GHSA-7pr7-27f4-hvhf
StackStorm st2 API Key auth.py privileges management
Priority MEDIUM 57
A security vulnerability has been detected in StackStorm st2 up to 3.9.0.
StackStorm
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9
Exploited now
StackStorm records in CISA KEVNo StackStorm vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-58674 CVE-2026-85513 · GHSA-w6wr-mr8c-m255
StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
Priority MEDIUM 57
A weakness has been identified in StackStorm st2 up to 3.9.0.
TI-2021-20192 CVE-2021-44657 · GHSA-734q-6f9p-wxpv
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode…
Priority MEDIUM 43
In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands.
TI-2022-21635 CVE-2022-44009
Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the…
Priority MEDIUM 40
Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive…
TI-2021-09734 CVE-2021-28667
StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all…
Priority LOW 38
StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space.
TI-2019-06999 CVE-2019-9580 · GHSA-v3xf-5q99-hxf5
In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to…
Priority LOW 33
In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS.
TI-2022-21463 CVE-2022-43706
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to…
Priority LOW 25
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for o…
TI-2018-14401 CVE-2018-20345 · GHSA-6vf5-fpqv-99pp
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x…
Priority LOW 25
Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datast…