CVE-2026-85513: StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management
A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privilege management. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Prior advisory CVE-2022-44009 was reported as a follow-up on the same sink, but this issue is distinct: it needs no Jinja RBAC und affects default install with RBAC disabled. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
StackStorm st2to a version that resolves this vulnerability.Fixed in 3.9.0 - Configuration
Patch the function assert_user_is_admin_if_user_query_param_is_provided in st2api/st2api/controllers/v1/actionexecutions.py to fix improper privilege management caused by manipulation of the User argument in the NoOp RBAC backend.
StackStorm st2 (NoOp RBAC backend) assert_user_is_admin_if_user_query_param_is_provided (st2api/st2api/controllers/v1/actionexecutions.py) = Implement proper privilege management logic to prevent User argument manipulation from granting improper privileges
Event History
Frequently Asked Questions
Are default StackStorm deployments affected?
Yes. The issue affects default installations with RBAC disabled because it involves the NoOp RBAC backend.
What does an attacker need to exploit this issue?
The attack can be performed remotely and requires low privileges. No user interaction is required.
Is exploit code available?
Yes. A public exploit has been made available and could be used in attacks.
Which versions are identified as affected?
StackStorm st2 versions up to 3.9.0 are identified as affected.
Is a fix or vendor response available?
The provided information does not identify a fix. It states that the project was notified through an issue report but had not responded at the time of publication.