Read the docs
TI-2026-33328 Aliases CVE-2026-45579GHSA-9jpv-c7p4-997x

DIRAC: RCE in RequestManager due to eval on untrusted input

Priority MEDIUM 44CWE-95Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.

Summary

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00864 58th percentileScored 2026-11-07
Fix Fixed DIRAC (DIRACGrid): 8.0.79, 9.0.22, 9.1.10DIRAC (PyPI): 8.0.79, 9.0.22, 9.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DIRACGridDIRAC6r0 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.108.0.79, 9.0.22, 9.1.10Patch availableCNA
—DIRAC (PyPI)6 to before 8.0.798.0.79Patch availableGHSA-9jpv-c7p4-997x
—DIRAC (PyPI)8.1.0a1 to before 9.0.229.0.22Patch availableGHSA-9jpv-c7p4-997x
—DIRAC (PyPI)9.1.0 to before 9.1.109.1.10Patch availableGHSA-9jpv-c7p4-997x
  • DIRAC VendorDIRACGrid Affected 6r0 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.10 Fixed in 8.0.79, 9.0.22, 9.1.10 Patch available CNA
  • DIRAC (PyPI) Vendor— Affected 6 to before 8.0.79 Fixed in 8.0.79 Patch available GHSA-9jpv-c7p4-997x
  • DIRAC (PyPI) Vendor— Affected 8.1.0a1 to before 9.0.22 Fixed in 9.0.22 Patch available GHSA-9jpv-c7p4-997x
  • DIRAC (PyPI) Vendor— Affected 9.1.0 to before 9.1.10 Fixed in 9.1.10 Patch available GHSA-9jpv-c7p4-997x

Remediation

  • Fix · CNA DIRAC (DIRACGrid) Fixed in 8.0.79, 9.0.22, 9.1.10
  • Fix · GHSA-9jpv-c7p4-997x DIRAC (PyPI) Fixed in 8.0.79 Advisory →
  • Fix · GHSA-9jpv-c7p4-997x DIRAC (PyPI) Fixed in 9.0.22 Advisory →
  • Fix · GHSA-9jpv-c7p4-997x DIRAC (PyPI) Fixed in 9.1.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45579
  2. 2026-10-03 Alias added: GHSA-9jpv-c7p4-997x

References

Other 11

  • TI-2025-33911 DiracX-Web login page has Open Redirect vulnerability CVSS 3.1MEDIUM 4.7
  • TI-2026-44154 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval CVSS 3.1CRITICAL 9.9
  • TI-2024-16342 TokenManager not checking permissions on cached tokens in DIRAC CVSS 3.1CRITICAL 9.1
  • TI-2026-44155 DIRAC: Pilot code downloaded over unverified HTTPS connection CVSS 3.1HIGH 8.1
  • TI-2024-19672 DIRAC: Unauthorized users can read proxy contents during generation CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences