StackStorm st2 EUVD-2026-71087

The attacker must hold a valid StackStorm user account with API access at any privilege level (PR:L). The critical enabling condition is that the StackStorm deployment uses the default NoOp RBAC backend - meaning RBAC has not been explicitly enabled and configured. Deployments that have activated an enterprise RBAC backend (replacing the NoOp backend) are not vulnerable to this specific issue. No user interaction, special platform configuration beyond the default install, or elevated privileges are required. Exploitation is limited to users who can authenticate to the st2api network endpoint; network-isolated deployments reduce but do not eliminate risk if internal accounts are compromised.

The CVSS 4.0 score of 5.3 with exploitation status E:P (proof-of-concept available) presents moderate but practically significant risk in context. Authentication at the low-privilege level (PR:L) is required, which is the primary limiting factor - an attacker must first hold a valid StackStorm account. However, StackStorm is an automation platform routinely handling privileged infrastructure operations, and horizontal privilege escalation to another user's execution context can expose sensitive workflow parameters, embedded credentials, API tokens, or allow unauthorized triggering of infrastructure actions under another user's identity. The fact that this affects default installations (RBAC disabled) rather than a non-default configuration dramatically broadens the realistic attack surface: most StackStorm deployments that have not explicitly enabled an RBAC backend are vulnerable. No KEV listing is present, and EPSS data is absent from the input - exploitation scope is currently unknown beyond POC availability. The prior related CVE-2022-44009 on the same sink suggests this code area has been under scrutiny; vendor non-response is a data gap and risk amplifier.

An attacker with a low-privilege StackStorm account - potentially a shared service account, a compromised developer credential, or a user with minimal permissions - sends a crafted HTTP GET request to /v1/actionexecutions?user=admin against the st2api endpoint. Because the NoOp RBAC backend silently skips the admin enforcement check, the API returns execution records scoped to the admin user, exposing workflow details, embedded secrets, and action history. A public proof-of-concept is available via GitHub issue #6379, lowering the exploitation barrier significantly.