Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-45579DIRAC: RCE in RequestManager due to eval on untrusted input

Critical 9.9

In plain English

A critical-severity security flaw in DIRAC from DIRACGrid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)0.9%top 41.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIdirac8.0.79GHSA-9jpv-c7p4-997x
PyPIdirac9.0.22GHSA-9jpv-c7p4-997x
PyPIdirac9.1.10GHSA-9jpv-c7p4-997x
PyPIdirac8.0.79, 9.0.22, 9.1.10PYSEC-2026-3462

Affected products (as reported)

VendorProductVersions
DIRACGrid DIRAC >= 6r0, < 8.0.79>= 9.0.0a1, < 9.0.22>= 9.1.0, < 9.1.10

Weakness: CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References