PT-2026-29183 · Scitokens · Scitokens

Pmcao · Publicado 2026-03-31 · Atualizado 2026-04-04 · CVE-2026-32714

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SciTokens versions prior to 1.9.6

Description SciTokens is a reference library for generating and using SciTokens. The KeyCache class was susceptible to SQL Injection due to the use of Python’s str.format() function to construct SQL queries with user-supplied data, such as the issuer and key id. This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. The issue was addressed in version 1.9.6.

Recommendations Update to SciTokens version 1.9.6 or later.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-32714

GHSA-RH5M-2482-966C

OPENSUSE-SU-2026:10491-1

Produtos afetados

Scitokens

Referências · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32714.json · Exploit
• 🔥 https://github.com/scitokens/scitokens/security/advisories/GHSA-rh5m-2482-966c · Exploit
• https://github.com/scitokens/scitokens/commit/3dba108853f2f4a6c0f2325c03779bf083c41cf2 · Correção
• https://github.com/scitokens/scitokens/releases/tag/v1.9.6 · Nota
• https://github.com/scitokens/scitokens · Nota
• https://suse.com/security/cve/CVE-2026-32727 · Nota
• https://twitter.com/CosmicBytez/status/2039182108468678722 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-32714 · Nota
• https://suse.com/security/cve/CVE-2026-32716 · Nota
• https://osv.dev/vulnerability/CVE-2026-32714 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2026:10491-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-rh5m-2482-966c · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2039361441459765654 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2038804566611796055 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2038916047957586270 · Publicação no Twitter