Stackstorm - vulnerabilities (CVEs)

8 CVEs in 2 products, 0 in the last 30 days, newest from 2026-09-04.

Products

• Stackstorm - 6 CVEs
• St2 - 2 CVEs

Newest CVEs of Stackstorm

• CVE-2026-85514 - CVSS 6.3 (medium), 2026-09-04: A security vulnerability has been detected in StackStorm st2 up to 3.9.0. Impacted is an unknown function of the file st2api/st2api/controllers/v1/auth.py of…
• CVE-2026-85513 - CVSS 6.3 (medium), 2026-09-04: A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_provided of the file…
• CVE-2022-44009 - CVSS 7.5 (high), 2022-12-06: Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of…
• CVE-2022-43706 - CVSS 5.4 (medium), 2022-12-05: Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject…
• CVE-2021-44657 - CVSS 8.8 (high), 2021-12-15: In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus allows execution of unsafe system commands. Jinja does not…
• CVE-2021-28667 - CVSS 7.5 (high), 2021-03-18: StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the…
• CVE-2019-9580 - CVSS 6.1 (medium), 2019-03-09: In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value,…
• CVE-2018-20345 - CVSS 5.3 (medium), 2018-12-21: Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before 2.10.1 allows an attacker (who has a StackStorm account and…