SciTokens is vulnerable to SQL Injection in KeyCache
Date: 2026-03
Affected: pip/scitokens
Attack vector: sql-injection
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2026-32714
CWE: CWE-89
CVSS: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

### Summary The `KeyCache` class in `scitokens` was vulnerable to SQL Injection because it used Python's `str.format()` to construct SQL queries with user-supplied data (such as `issuer` and `key_id`). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. Ran the POC below locally. ### Details **File:** `src/scitokens/utils/keycache.py` ### Vulnerable Code Snippets **1. In `addkeyinfo` (around line 74):** ```python curs.execute("DELETE FROM keycache WHERE issuer = '{}' AND key_id = '{}'".format(issuer, key_id)) ``` **2. In `_addkeyinfo` (around lines 89 and 94):** ```python insert_key_statement = "INSERT OR REPLACE INTO keycache VALUES('{issuer}', '{expiration}', '{key_id}', \ '{keydata}', '{next_update}')" # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.time()+cache_timer, key_id=key_id, keydata=json.dumps(keydata), next_update=time.time()+next_update)) ``` **3. In `_delete_cache_entry` (around line 128):** ```python curs.execute("DELETE FROM keycache WHERE issuer = '{}' AND key_id = '{}'".format(issuer, key_id)) ``` **4. In `_add_negative_cache_entry` (around lines 148 and 152):** ```python insert_key_statement = "INSERT OR REPLACE INTO keycache VALUES('{issuer}', '{expiration}', '{key_id}', \ '{keydata}', '{next_update}')" # ... curs.execute(insert_key_statement.format(issuer=issuer, expiration=time.tim


Mitigations:

Architectural layers (MAESTRO):