CVE-2026-32727: 
Python vulnerability analysis and mitigation

CVE-2026-32727 is a path traversal vulnerability (CWE-22) in the SciTokens Python reference library that allows authenticated attackers to bypass scope-based directory access controls. The flaw exists in the Enforcer component of all versions prior to 1.9.7, where dot-dot (..) sequences in a token's scope or scp claim can be used to escape intended directory restrictions. It was published on March 31, 2026, with a patch released in version 1.9.7. The CVSS v3.1 base score is 6.5 (Medium) per NVD, while the GitHub Security Advisory assigns a score of 8.1 (High) reflecting both confidentiality and integrity impact (GitHub Advisory, Red Hat Bugzilla).

The root cause (CWE-22) lies in the _check_scope and _scope_path_matches methods in src/scitokens/scitokens.py, combined with the normalize_path function in src/scitokens/urltools.py. When a token is verified, the Enforcer extracts the authorized path from the scope claim and passes it through urltools.normalize_path, which uses posixpath.normpath to resolve relative segments — converting a scope like read:/home/user1/.. to read:/home. The subsequent startswith comparison then incorrectly grants access to any path under the normalized parent (e.g., /home/user2). Attackers can also use URL-encoded variants such as %2e%2e, .%2e, or %2e. to bypass simple string filters, since normalize_path unquotes the path before normalizing. A scope of read:/anything/.. resolves to read:/, effectively granting access to the entire resource space (GitHub Advisory, Fix Commit).

Any authenticated user holding a valid SciToken can bypass path-based access controls and gain read (and potentially write) access to directories and files outside those authorized by their token's scope claim. In the worst case, a scope like read:/anything/.. resolves to the root path /, granting access to all resources the enforcer guards — including sensitive files such as /etc/passwd. The GitHub Advisory rates both confidentiality and integrity as High, indicating that unauthorized data disclosure and data modification are both possible consequences (GitHub Advisory).

A proof-of-concept Python script is publicly available in the GitHub Security Advisory, demonstrating the bypass by instantiating a SciToken with a malicious scope and calling Enforcer.test() to confirm unauthorized access is granted (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.053% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Obtain a valid SciToken: The attacker must have a legitimate SciToken issued by a trusted issuer, or be in an environment where tokens are issued with user-influenced sub-paths in the scope claim.
2. Craft a malicious scope claim: Set the token's scope (or scp) claim to include a dot-dot traversal sequence, e.g., read:/home/user1/.. (to access /home) or read:/anything/.. (to access the root /). URL-encoded variants such as read:/foo/%2e%2e/bar can also be used to evade simple string filters.
3. Submit the token to the target application: Present the crafted token to any application using the SciTokens Enforcer for access control (versions < 1.9.7).
4. Trigger path normalization: The Enforcer calls urltools.normalize_path on the scope path, resolving read:/home/user1/.. to read:/home.
5. Bypass the startswith check: When the application requests access to a path like /home/user2, the Enforcer's _scope_path_matches method evaluates "/home/user2".startswith("/home/") as True, granting unauthorized access.
6. Access unauthorized resources: The attacker can now read (or write, depending on the scope action) files and directories outside their intended authorization boundary (GitHub Advisory).

• Logs: Application or Enforcer logs showing token validation for scope claims containing .., %2e%2e, .%2e, or %2e. sequences (e.g., scope: read:/home/user1/.. or scope: read:/foo/%2e%2e/bar).
• Logs: Successful authorization decisions for paths that fall outside the literal scope path specified in the token (e.g., token scope restricted to /home/user1 but access granted to /home/user2 or /etc/passwd).
• Application Behavior: Unexpected file access or data retrieval from directories not explicitly authorized by the token's scope, particularly sibling directories or sensitive system paths.
• Token Inspection: JWT tokens with scope or scp claims containing traversal sequences (.., %2e%2e, .%2e, %2e., %2E%2E) when decoded (GitHub Advisory).

Upgrade the SciTokens library to version 1.9.7 or later, which introduces a _normalize_scope_path method that rejects any scope path containing .. segments (including URL-encoded variants) before normalization, and raises InvalidAuthorizationResource as a ValidationFailure so Enforcer.test() reliably returns False (v1.9.7 Release, Fix Commit). No configuration-based workaround is available for unpatched versions; upgrading is the only reliable remediation. After upgrading, administrators should audit token issuance policies to ensure user-controlled input cannot influence scope path values, and review access logs for historical traversal attempts.

Red Hat tracked the vulnerability via Bugzilla (Bug 2453286) and published a CVE advisory, indicating awareness among enterprise Linux distributors (Red Hat Bugzilla, Red Hat CVE). The vulnerability was noted on Bluesky by CVE tracking accounts shortly after disclosure. Community reaction has been limited given the specialized nature of the SciTokens library, which is primarily used in scientific computing and research data access environments.