CVE-2026-32726: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-32726 is a sibling-path authorization bypass vulnerability in the SciTokens C++ library (scitokens-cpp). Prior to version 1.4.1, the enforcer's scope validation used a raw string-prefix comparison instead of a path-segment-aware check, allowing a token scoped to one path to incorrectly authorize access to sibling paths sharing the same prefix. All tagged releases from v0.1.0 through v1.4.0 are affected. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization). The vulnerable logic resided in src/scitokens_internal.cpp within the Enforcer::scope_validator function, which compared the requested resource path against the token's authorized scope path using requested_path.substr(0, path.size()) == path — a raw byte-prefix match with no path-segment boundary enforcement. This meant a token with scope=read:/john would incorrectly authorize access to /johnathan or /johnny because those strings begin with /john. The same flaw affected compatibility handling for condor:/WRITE, where paths like /WRITEUP were incorrectly accepted. The fix, introduced in commit decfe2f, replaced the raw prefix check with a path_matches_scope() function that requires the next character after the authorized prefix to be / (or an exact match, or the authorized path to be /) (GitHub Advisory, Fix Commit).

An authenticated attacker holding a valid SciToken scoped to a specific path can gain unauthorized read or write access to sibling namespaces whose paths share the same string prefix. In shared storage or multi-tenant environments — common in scientific computing and data grid deployments — this allows one user or tenant to access another's data without authorization, resulting in high confidentiality and integrity impact. Availability is not directly affected. The scope of impact is limited to the resources accessible through the vulnerable enforcer instance, but in federated or large-scale research infrastructure, the blast radius could be significant (GitHub Advisory).

A proof-of-concept demonstrating the authorization bypass is publicly documented in the GitHub Security Advisory, with concrete reproduction steps. The EPSS score is approximately 0.028% (low probability of near-term exploitation). There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privilege authenticated user with a valid SciToken, making it accessible to any legitimate token holder in a multi-tenant deployment (GitHub Advisory).

1. Obtain a valid SciToken: Acquire or create a legitimate SciToken with a path-scoped claim, e.g., scope=read:/john, through normal authentication channels for the target system.
2. Identify a sibling path target: Enumerate or guess sibling paths that share the same prefix as the authorized scope (e.g., /johnathan, /johnny) but belong to a different user or tenant in the shared storage environment.
3. Submit a request to the enforcer: Call the enforcer (via the application or API using scitokens-cpp < 1.4.1) with the token, specifying authorization: read and requested resource: /johnathan.
4. Observe unauthorized access granted: The vulnerable prefix-match logic in Enforcer::scope_validator evaluates requested_path.substr(0, path.size()) == path, which returns true for /johnathan against /john, and grants access.
5. Access or modify sibling data: Use the incorrectly granted authorization to read or write data in the sibling namespace, potentially exfiltrating sensitive research data or corrupting another tenant's files (GitHub Advisory).

• Logs: Access logs showing successful authorization grants for resource paths that are siblings (not descendants) of the token's declared scope path (e.g., token scope /john but access granted to /johnathan or /johnny).
• Logs: Repeated enforcer validation calls from a single token targeting multiple path prefixes that differ only by suffix characters after the authorized path.
• Application Behavior: Unexpected cross-tenant data access events in shared storage systems where path namespaces are segregated by user or project prefix.
• Audit Trails: Token usage records showing a single token accessing resources outside its declared scope path, particularly in multi-tenant or federated research computing environments (GitHub Advisory).

Upgrade scitokens-cpp to version 1.4.1 or later, which replaces the raw prefix match with a path-segment-aware path_matches_scope() function (Fix Commit). As a defense-in-depth measure prior to patching, administrators should review token scope assignments to ensure authorized paths are sufficiently distinct (i.e., no two tenants share a common path prefix) to reduce the practical exploitability of the flaw. No configuration-only workaround fully mitigates the vulnerability; patching to 1.4.1 is the recommended and only complete remediation (GitHub Advisory).

The vulnerability was published by maintainer djw8605 via GitHub Security Advisory on March 30, 2026, with credit to reporter pmcao. Social media activity was observed on Mastodon and Bluesky shortly after disclosure, with aggregator accounts noting the High severity rating. Coverage appeared on vulnerability tracking platforms including VulDB, CVEFeed, and Tenable (Nessus plugin 304769). No major vendor statements or significant independent researcher commentary beyond the advisory itself have been identified (GitHub Advisory).