CVE-2026-85514

MediumCVSS 6.3/10Last modified Sep 4, 2026

Description

A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of the component API Key Handler. Such manipulation of the argument api_key_api.user leads to improper privilege management. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-266CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2026
Last modified
Sep 4, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-855158.2In Bouncy Castle for Java before 1.86, a truncated OpenPGP encrypted message was accepted with no error reported, and on the SEIPD version 1CVE-2026-855167.3A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busproCVE-2026-855175.3A flaw has been found in code-projects Vehicle Management System 1.0. The impacted element is an unknown function of the file /vehicle_managCVE-2026-855186.1A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file pathCVE-2026-85524.3Heap buffer overflow in GPU in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memoryCVE-2026-855209.3Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. ACVE-2026-855225.3A vulnerability was detected in valkey-io valkey up to 9.5.4/9.1.0. Affected by this vulnerability is the function createSlotImportJob of thCVE-2026-855238.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information TechnologieCVE-2026-855257.4Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted asCVE-2026-855269.9Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with instance creation privCVE-2026-855285.3Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credeCVE-2026-855295.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th