What is the CVSS score of CVE-2026-32714?

CVE-2026-32714 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Python are affected by CVE-2026-32714?

CVE-2026-32714 is a critical SQL injection vulnerability in SciTokens Python library versions prior to 1.9.6 that permits unauthenticated remote code execution against local SQLite databases through…. A patch is available.

How to fix or mitigate CVE-2026-32714?

Within 24 hours: Identify all systems running SciTokens versions before 1.9.6 using software inventory tools and isolate affected services from untrusted network access. Within 7 days: Contact SciTokens project for patch availability and timeline; if patch is released, test and deploy to all affected instances immediately. Within 30 days: Implement input validation and parameterized queries as interim controls; conduct forensic review of SQLite database logs for evidence of exploitation attempts; deploy network-level restrictions limiting token issuance sources to known trusted entities only.

Python CVE-2026-32714

EUVD-2026-17293 CRITICAL

SQL Injection (CWE-89)

2026-03-31 GitHub_M

GHSA-rh5m-2482-966c

Python SQLi

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 02:30 euvd

EUVD-2026-17293

Analysis Generated

Mar 31, 2026 - 02:30 vuln.today

CVE Published

Mar 31, 2026 - 01:31 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in version 1.9.6.

AnalysisAI

SQL injection in SciTokens Python library allows unauthenticated remote code execution against the local SQLite database. The KeyCache class improperly uses str.format() to construct SQL queries with attacker-controlled issuer and key_id parameters, enabling arbitrary SQL command execution. Affects all versions prior to 1.9.6. CVSS 9.8 (Critical) with network attack vector, low complexity, and no privileges required. No CISA KEV listing indicates no confirmed active exploitation at time of analysis, though the straightforward nature of SQL injection and public patch details increase exploitation risk.

Technical ContextAI

SciTokens is a Python reference library for generating and validating SciTokens (distributed authorization tokens used in scientific computing environments). The vulnerability resides in the KeyCache class, which stores cryptographic key material in a local SQLite database. Python's str.format() method was used to dynamically build SQL queries incorporating user-supplied fields like issuer URL and key_id from incoming tokens. Unlike parameterized queries, str.format() performs simple string substitution without sanitization, allowing attackers to inject SQL metacharacters and commands. This is a textbook CWE-89 (SQL Injection) vulnerability. The affected product per CPE is scitokens:scitokens (Python package), with the vulnerability present in all versions before 1.9.6. SQLite's limited privilege model confines the attack surface to the application's database, but attackers can still read sensitive cached keys, modify validation logic, or potentially achieve local code execution through SQLite extensions if enabled.

RemediationAI

Upgrade to SciTokens version 1.9.6 or later immediately. The fix replaces str.format() SQL construction with parameterized queries using SQLite's parameter substitution, eliminating injection vectors. Installation via pip: 'pip install --upgrade scitokens>=1.9.6'. Verify the installed version with 'pip show scitokens'. The patched release is available at https://github.com/scitokens/scitokens/releases/tag/v1.9.6. No workarounds are recommended; the SQL injection is structural and cannot be mitigated through configuration changes. If immediate patching is not feasible, consider isolating SciTokens-dependent services from untrusted networks and implementing strict input validation at application boundaries, though these are stopgap measures only. Review application logs for suspicious issuer or key_id values containing SQL metacharacters (quotes, semicolons, UNION keywords) as potential indicators of exploitation attempts.