Description

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-09-04T13:20:11.300Z",
  "pubdate": "2026-09-04T13:20:11.300Z",
  "executiveSummary": "A critical security vulnerability exists in StackStorm st2 (up to version 3.9.0) related to improper privilege management within the API Key Handler component.\nThe vulnerability resides in the st2api/st2api/controllers/v1/auth.py file, specifically involving the api_key_api.user argument.\nThis flaw allows a remote attacker to manipulate the user context associated with an API key, potentially leading to unauthorized privilege escalation.\nThe risk is significant as it compromises the integrity of the authentication and authorization mechanisms governing system access.\nAs the exploit is publicly disclosed and the vendor has not yet addressed the report, the attack surface remains exposed, necessitating immediate proactive defensive measures to restrict unauthorized access to the API controller.",
  "technicalDetails": "The vulnerability is localized within the API Key Handler component of the StackStorm st2 application, specifically targeting the logic implemented in st2api/st2api/controllers/v1/auth.py.\nThe root cause is an improper privilege management flaw where the application fails to adequately validate or restrict the api_key_api.user argument during API key interaction.\nThis failure allows an authenticated or unauthenticated attacker to manipulate the input parameter to map API key requests to unauthorized user identities or elevated roles.\nExploitation is performed remotely by crafting a request that influences the internal handling of the user context. By injecting or modifying the api_key_api.user attribute, an attacker can bypass standard authorization checks that govern the mapping between an API key and its assigned user permissions.\nWhen the st2api controller processes the input, it consumes the tainted user identity provided in the request instead of relying on secure, server-side validated session or key-to-user binding metadata.\nThis leads to a post-exploitation state where the attacker inherits the security context of the target user, potentially granting them administrative or highly privileged capabilities within the StackStorm environment.\nThe attack flow follows a sequential process: First, the attacker identifies the API endpoint responsible for key management within the v1/auth controller. Second, the attacker submits a request targeting the vulnerable parameter. Third, the API controller fails to sanitize or verify the api_key_api.user field against the legitimate owner of the key. Finally, the system executes the requested action under the context of the manipulated user identity, resulting in unauthorized privilege escalation.\nThe impact includes full administrative compromise of the automation controller if the targeted user holds administrative roles, potentially allowing the execution of arbitrary workflows, access to sensitive configurations, and exfiltration of data processed by the StackStorm instance."
}