shouldiuse.io

Categories

VERDICT

StackStorm Review

Depends

Should I use StackStorm?

StackStorm connects all your apps, services, and workflows. - stackstorm.com

· 1 month ago

Buy it if you're a DevOps or platform team that wants powerful, self-hosted open-source workflow automation and can patch it promptly. Skip it if you're a small team or non-technical user wanting simple app-to-app automation — use Zapier or n8n instead.

Confidence

Low. Based on 2 public sources; no independent reviews, pricing pages, or named customers found.

Ratings

  • Value for money
  • Ease of useNo usability evidence found
  • Feature depth
  • Support qualityNo support evidence found
  • Security posture

Pricing

Free

Open source (self-hosted)

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • DevOps and platform engineering teams
  • Ops teams gluing many internal tools
  • Enterprises wanting self-hosted open-source orchestration

Not for

  • Small teams that just need Zapier-style app automation
  • Non-technical users wanting a no-code interface
  • Teams with no engineers to install, run, and patch it
  • Buyers wanting a managed SaaS with vendor support

Gotchas - check before you buy

high

RBAC bypass (CVE-2022-44009) existed even with RBAC enabled; fixed only in v3.8.0

high

Web UI XSS via rule injection affected all versions before 3.8.0

high

Running anything but the latest release leaves you exposed to known exploits

medium

Guess: no paid tiers surfaced — expect community support, not vendor SLAs

Pros and cons

Pros

  • Handles everything from simple if/then rules to complex workflows
  • Integrates with existing infrastructure without changing current processes
  • Open source with enterprise pedigree
  • Transparent, responsible security disclosure with 48-hour acknowledgment

Cons

  • Five high-severity CVEs disclosed between 2019 and 2022
  • Older versions allowed arbitrary code execution via Jinja (CVE-2021-44657)
  • Staying safe requires prompt upgrades to the latest release

Sources & method

- 2 sources - Transparent responsible disclosure; 5 high-severity CVEs (2019–2022), all fixed by v3.8.0 — run the latest release.

official x1security x1
  • CVE-2022-44009 — RBAC bypass on K/V datastore, Version 3.7.0 didn't check permissions in Jinja filters, exposing other users' K/V pairs. Fixed in v3.8.0.
  • CVE-2022-43706 — Web UI XSS via rules injection, Users with rule write access could inject scripts executed in other users' browsers. Affected all versions before 3.8.0.
  • CVE-2021-44657 — Unsandboxed Jinja allowed arbitrary code execution, Jinja ran without sandbox before 3.6.0, letting logged-in users execute unsafe system commands.
  • CVE-2021-28667 — Logging infinite loop causing DoS, Before 3.4.1, logging Unicode in certain locales could exhaust memory and disk.
  • CVE-2019-9580 — CORS protection bypass, Listed on the security page; details truncated in the source reviewed.

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 2

    Sources

  • Analyzed

  • Value for money: 4/5. Open-source core, free to self-host
  • Ease of use. No usability evidence found
  • Feature depth: 4/5. Rules to complex workflows; broad integration claims
  • Support quality. No support evidence found
  • Security posture: 3/5. Transparent fixes, but 5 high CVEs 2019–2022
  • Open source License Free to self-host
  • 5 Disclosed CVEs High severity, 2019–2022, all fixed
  • ≤48h Security response Acknowledgment of reported issues

Pricing

Open source (self-hosted)

Free

  • Full rules and workflow automation engine
  • Integrations with existing infrastructure

Security

Transparent responsible disclosure; 5 high-severity CVEs (2019–2022), all fixed by v3.8.0 — run the latest release.

  • CVE-2022-44009 — RBAC bypass on K/V datastoreVersion 3.7.0 didn't check permissions in Jinja filters, exposing other users' K/V pairs. Fixed in v3.8.0.²
  • CVE-2022-43706 — Web UI XSS via rules injectionUsers with rule write access could inject scripts executed in other users' browsers. Affected all versions before 3.8.0.²
  • CVE-2021-44657 — Unsandboxed Jinja allowed arbitrary code executionJinja ran without sandbox before 3.6.0, letting logged-in users execute unsafe system commands.²
  • CVE-2021-28667 — Logging infinite loop causing DoSBefore 3.4.1, logging Unicode in certain locales could exhaust memory and disk.²
  • CVE-2019-9580 — CORS protection bypassListed on the security page; details truncated in the source reviewed.²

What users say

No independent user reviews or community quotes were found in the sources reviewed.

Alternatives

Compare StackStorm with each alternative.

  • Zapier

    No-code app automation for non-technical teams

    StackStorm vs Zapier

  • n8n

    Self-hostable workflow automation, lighter than StackStorm

  • Ansible

    Simpler config management and automation for DevOps

  • Rundeck

    Ops runbook automation with friendlier operations UI

Full analysis

Based on 2 public sources; no independent reviews, pricing pages, or named customers found.

Powerful open-source DevOps automation. Great for platform teams who self-host; overkill for small teams — try Zapier or n8n.

Methodology

Based on 2 public sources; no independent reviews, pricing pages, or named customers found.

Read how a report is made.

Sources

  1. StackStorm homepagestackstorm.com
    official
  2. StackStorm security pagestackstorm.com
    security

Add this review to your site

This check for StackStorm says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends StackStorm Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.