Stackstorm vulnerabilities

Products

• Stackstorm 6
• St2 2

Newest

• stackstorm st2 StackStorm st2 API Key auth.py privileges management CVE-2026-85514 5.3 MediumSeptember 4, 2026
• stackstorm st2 StackStorm st2 NoOp RBAC backend actionexecutions.py privileges management CVE-2026-85513 5.3 MediumSeptember 4, 2026
• stackstorm Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the e… CVE-2022-44009 7.5 HighDecember 5, 2022
• stackstorm Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be exec… CVE-2022-43706 5.4 MediumDecember 5, 2022
• stackstorm In StackStorm versions prior to 3.6.0, the jinja interpreter was not run in sandbox mode and thus... CVE-2021-44657 8.8 HighDecember 15, 2021
• stackstorm StackStorm st2 Infinite Loop Condition CVE-2021-28667 7.5 HighMarch 18, 2021
• stackstorm In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass... CVE-2019-9580 Public exploit 6.1 MediumMarch 9, 2019
• stackstorm Incorrect access control in StackStorm API (st2api) in StackStorm before 2.9.2 and 2.10.x before... CVE-2018-20345 5.3 MediumDecember 21, 2018