CVE-2026-32714 - Vulnerability Analysis

Overview

SciTokens < 1.9.6 contains a SQL injection caused by unsafe use of str.format() in KeyCache class for SQL query construction, letting attackers execute arbitrary SQL commands on local SQLite database, exploit requires crafted input.

Severity & Score

Impact

Attackers can execute arbitrary SQL commands on the local database, potentially leading to data compromise or corruption.

Mitigation

Upgrade to version 1.9.6 or later.

References

• https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6
• https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 31, 2026

🔴 CVE-2026-32714 - Critical (9.8) SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (su... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-32714/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner