CVE-2026-32714 in SciTokens

摘要 (英语)

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.

负责

GitHub_M

预定

2026-03-13

披露

2026-03-31

条目

VulDB provides additional information and datapoints for this CVE:

标识符	漏洞	CWE	可利用	对策	CVE
354307	SciTokens str.format SQL注入	89	未定义	官方修复	CVE-2026-32714