CVE-2026-57485 Stirling-Tools CVE debrief

Who should care

Defenders responsible for Stirling-PDF deployments should assess exposure and apply the fix, as the vulnerability allows for impersonation and internal endpoint access. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the system is updated to version 2.9.0 or later to mitigate the risk. Immediate action is necessary to prevent potential unauthorized access and data breaches.

Why it matters

CVE-2026-57485 is a high-severity vulnerability in Stirling-PDF that allows an authenticated user to retrieve an API key, impersonate an internal service account, bypass rate limits, and access internal endpoints. Defenders should prioritize verifying exposure and applying the fix.

• An authenticated user can retrieve the STIRLING-PDF-BACKEND-API-USER API key
• The API key can be used to impersonate the internal service account
• Normal rate limits can be bypassed
• Internal endpoints can be accessed

Technical summary

The /api/v1/pipeline/handleData endpoint in Stirling-PDF injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests, allowing an authenticated ROLE_USER to retrieve the key and impersonate the internal service account. This vulnerability enables bypassing normal rate limits and accessing internal endpoints, including /api/v1/info/requests/all and /api/v1/info/load/all. The issue is addressed in version 2.9.0, which removes the API key injection vulnerability. Defenders should prioritize verifying exposure and applying the fix to prevent exploitation.

Defensive priority

Defenders should prioritize verifying exposure and applying the fix, as the vulnerability allows for impersonation and internal endpoint access.

Recommended defensive actions

• Verify if the system is running a version prior to 2.9.0 and apply the fix if necessary
• Restrict access to the /api/v1/pipeline/handleData endpoint
• Monitor for suspicious activity on internal endpoints
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected deployments and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.