CVE-2026-32714: SciTokens Library SQLi Vulnerability

CVE-2026-32714 Overview

CVE-2026-32714 is a SQL Injection vulnerability in the SciTokens reference library, a widely-used component for generating and using SciTokens in federated identity management systems. Prior to version 1.9.6, the KeyCache class was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database.

Critical Impact
Attackers can execute arbitrary SQL commands against the local SQLite database, potentially leading to unauthorized data access, data manipulation, or complete database compromise.

Affected Products

SciTokens versions prior to 1.9.6
Applications and services using the SciTokens library with the vulnerable KeyCache class
Systems relying on SciTokens for federated identity token management

Discovery Timeline

2026-03-31 - CVE-2026-32714 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-32714

Vulnerability Analysis

This vulnerability exists within the KeyCache class of the SciTokens library. The root cause is the improper use of Python's str.format() method to construct SQL queries dynamically. When user-controlled data such as the issuer or key_id parameters are passed directly into the format string, the resulting SQL query becomes susceptible to injection attacks.

SciTokens is a reference implementation for handling authorization tokens in scientific computing environments. The KeyCache class manages cryptographic keys used for token validation, storing them in a local SQLite database. An attacker who can control the issuer or key_id values—potentially through crafted tokens or API requests—can inject malicious SQL syntax that executes against this database.

Root Cause

The vulnerability stems from using string formatting (str.format()) instead of parameterized queries when building SQL statements. This is a classic CWE-89 (SQL Injection) pattern where untrusted input is concatenated or formatted directly into SQL query strings without proper sanitization or parameterization.

In Python applications using SQLite, the secure approach is to use parameterized queries with placeholder syntax (e.g., cursor.execute("SELECT * FROM keys WHERE issuer = ?", (issuer,))), which ensures that user input is treated as data rather than executable SQL code.

Attack Vector

The attack vector is network-based and does not require authentication or user interaction. An attacker can exploit this vulnerability by supplying specially crafted values for the issuer or key_id parameters that contain SQL injection payloads. When these values are processed by the vulnerable KeyCache class, the injected SQL is executed against the SQLite database.

Potential attack scenarios include:

Extracting sensitive key material from the database
Modifying or deleting cached cryptographic keys
Bypassing authentication mechanisms that rely on token validation
Causing denial of service by corrupting the key cache database

The vulnerability mechanism involves Python's str.format() being used to interpolate user-supplied values directly into SQL query strings. For detailed technical information about the vulnerable code pattern and the fix, refer to the GitHub Security Advisory GHSA-rh5m-2482-966c and the security patch commit.

Detection Methods for CVE-2026-32714

Indicators of Compromise

Unusual or malformed values in token issuer fields containing SQL syntax characters (e.g., single quotes, semicolons, UNION, SELECT)
Unexpected database errors or exceptions from the SciTokens KeyCache component
Anomalous modifications to the SciTokens SQLite database file
Log entries showing unusual token validation requests with suspicious parameter values

Detection Strategies

Monitor application logs for SQL-related errors originating from the SciTokens library
Implement input validation rules to detect SQL injection patterns in issuer and key_id fields
Deploy web application firewalls (WAF) with SQL injection detection rules for services using SciTokens
Use database activity monitoring to detect unauthorized SQL commands against the key cache database

Monitoring Recommendations

Enable verbose logging for the SciTokens library to capture token validation events
Configure alerting for database integrity changes to the key cache SQLite file
Implement anomaly detection for authentication patterns that may indicate token manipulation
Review audit logs for services that accept SciTokens for unusual authentication patterns

How to Mitigate CVE-2026-32714

Immediate Actions Required

Upgrade SciTokens to version 1.9.6 or later immediately
Audit existing deployments to identify all instances of the SciTokens library
Review application logs for potential exploitation attempts
Verify the integrity of SQLite databases used by the KeyCache class

Patch Information

The vulnerability has been patched in SciTokens version 1.9.6. The fix replaces the vulnerable str.format() SQL query construction with properly parameterized queries that safely handle user-supplied data. Organizations should upgrade to this version or later to remediate the vulnerability.

Workarounds

If immediate upgrade is not possible, implement strict input validation on issuer and key_id values before they reach the SciTokens library
Deploy network-level controls to restrict access to services using SciTokens to trusted sources only
Consider temporarily disabling features that rely on the vulnerable KeyCache class until patching is complete
Implement application-level monitoring to detect and block SQL injection patterns in token parameters

bash

# Upgrade SciTokens to patched version
pip install --upgrade scitokens>=1.9.6

# Verify installed version
pip show scitokens | grep Version