CVE-2026-32716：SciTokens < 1.9.6 授权绕过漏洞

Scitokens 中的 CVE-2026-32716 由于范围路径验证不正确，可能导致授权绕过。Enforcer 组件使用简单的前缀匹配 (startswith) 来验证这些范围。这意味着具有对特定路径（例如 /john）访问权限的令牌也可以访问共享相同前缀的兄弟路径（例如 /johnathan、/johnny）。范围验证中的此错误允许攻击者访问未经授权的资源，从而危及应用程序安全。

Applications and services that rely on SciTokens for authentication and authorization, particularly those with complex or hierarchical scope structures, are at risk. Shared hosting environments where multiple applications share the same SciTokens instance are also particularly vulnerable, as a compromise in one application could potentially impact others.

• python / application: Examine application logs for unusual access patterns or requests to sibling paths after authentication. • python / application: Review SciTokens configuration files for overly permissive scope definitions. • python / application: Monitor for modifications to src/scitokens/scitokens.py file, specifically the validatescp and validatescope methods.

import os
import hashlib

def check_scitokens_version():
    try:
        import scitokens
        version = scitokens.__version__
        print(f"SciTokens version: {version}")
        if version <= '1.8.1':
            print("WARNING: Vulnerable to CVE-2026-32716. Upgrade recommended.")
        else:
            print("SciTokens version is up to date.")
    except ImportError:
        print("SciTokens is not installed.")

check_scitokens_version()

1. 2026-03-31Disclosure

   disclosure

2. 2026-03-31Patch

   patch

1. 已保留2026-03-13
2. 发布日期2026-03-31
3. EPSS 更新日期2026-04-07

为了减轻此漏洞，请将 Scitokens 升级到 1.9.6 或更高版本。此版本通过实施更严格的范围验证来修复此问题。请务必查阅 Scitokens 文档，了解有关如何升级以及如何验证已正确实施修复程序的详细说明。此外，请审查您的 Scitokens 配置，以确保范围定义尽可能具有限制性，仅将访问限制为必要的资源。