Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by GitHub_M

CVE-2026-61667DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

Critical 9.9

In plain English

A critical-severity SQL injection in DIRAC from DIRACGrid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.9Critical
Exploit odds (30 days)1.2%top 31.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIdirac8.0.79GHSA-m4m7-4cw8-62j6
PyPIdirac9.0.22GHSA-m4m7-4cw8-62j6
PyPIdirac9.1.10GHSA-m4m7-4cw8-62j6
PyPIdirac8.0.79, 9.0.22, 9.1.10PYSEC-2026-3463

Affected products (as reported)

VendorProductVersions
DIRACGrid DIRAC >= 6r0, < 8.0.79>= 9.0.0a1, < 9.0.22>= 9.1.0, < 9.1.10

Weakness: CWE-89, CWE-95 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References