Vulnerabilities

TI-2026-58675 CVE-2026-85514 · GHSA-7pr7-27f4-hvhf

StackStorm st2 API Key auth.py privileges management

MEDIUM 57

A security vulnerability has been detected in StackStorm st2 up to 3.9.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00366 Published 2026-09-04 No fix listed CWE-266

TI-2026-58674 CVE-2026-85513 · GHSA-w6wr-mr8c-m255

StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management

MEDIUM 57

A weakness has been identified in StackStorm st2 up to 3.9.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00425 Published 2026-09-04 No fix listed CWE-266

TI-2022-21635 CVE-2022-44009

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the…

MEDIUM 40

Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00636 Published 2022-12-05 No fix listed CWE-862

TI-2022-21463 CVE-2022-43706

Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to…

LOW 25

Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for o…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00418 Published 2022-12-05 No fix listed CWE-79

TI-2021-20192 CVE-2021-44657 · GHSA-734q-6f9p-wxpv

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode…

MEDIUM 43

In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02555 Published 2021-12-15 No fix listed

TI-2021-09734 CVE-2021-28667

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all…

LOW 38

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02475 Published 2021-03-18 No fix listed CWE-835

TI-2019-06999 CVE-2019-9580 · GHSA-v3xf-5q99-hxf5

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to…

LOW 33

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0299 Published 2019-03-09 No fix listed CWE-79

TI-2018-14401 CVE-2018-20345 · GHSA-6vf5-fpqv-99pp

Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x…

LOW 25

Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and is authenticated against the StackStorm API) to retrieve datast…

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00663 Published 2018-12-21 No fix listed

Vulnerabilities

Filters