CVE-2026-85514: Improper Privilege Management in StackStorm st2

This vulnerability affects StackStorm st2 versions up to 3.9.0 in the API Key Handler component, specifically in an unknown function within st2api/st2api/controllers/v1/auth.py. Improper handling of the api_key_api.user argument allows an attacker to manipulate privileges improperly. The attack vector is remote, and public exploit information is available. No official remediation or patch has been published by the vendor as of the data provided.

An attacker can remotely exploit this vulnerability to gain improper privileges within the StackStorm st2 system, potentially allowing unauthorized actions or access. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate risk due to network attack vector, low attack complexity, no user interaction required, but requiring some privileges and resulting in limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, users should monitor official StackStorm channels for updates. Until a fix is available, consider restricting network access to the affected API components and reviewing API key usage policies to limit exposure.