DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection, Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89 and CWE-95.
Summary
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| DIRACGrid | DIRAC | 6r0 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.10 | 8.0.79, 9.0.22, 9.1.10 | Patch available | CNA |
| — | DIRAC (PyPI) | 6 to before 8.0.79 | 8.0.79 | Patch available | GHSA-m4m7-4cw8-62j6 |
| — | DIRAC (PyPI) | 8.1.0a1 to before 9.0.22 | 9.0.22 | Patch available | GHSA-m4m7-4cw8-62j6 |
| — | DIRAC (PyPI) | 9.1.0 to before 9.1.10 | 9.1.10 | Patch available | GHSA-m4m7-4cw8-62j6 |
- DIRAC VendorDIRACGrid Affected 6r0 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.10 Fixed in 8.0.79, 9.0.22, 9.1.10 Patch available CNA
- DIRAC (PyPI) Vendor— Affected 6 to before 8.0.79 Fixed in 8.0.79 Patch available GHSA-m4m7-4cw8-62j6
- DIRAC (PyPI) Vendor— Affected 8.1.0a1 to before 9.0.22 Fixed in 9.0.22 Patch available GHSA-m4m7-4cw8-62j6
- DIRAC (PyPI) Vendor— Affected 9.1.0 to before 9.1.10 Fixed in 9.1.10 Patch available GHSA-m4m7-4cw8-62j6
Remediation
- Fix · CNA DIRAC (DIRACGrid) Fixed in 8.0.79, 9.0.22, 9.1.10
- Fix · GHSA-m4m7-4cw8-62j6 DIRAC (PyPI) Fixed in 8.0.79 Advisory →
- Fix · GHSA-m4m7-4cw8-62j6 DIRAC (PyPI) Fixed in 9.0.22 Advisory →
- Fix · GHSA-m4m7-4cw8-62j6 DIRAC (PyPI) Fixed in 9.1.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-61667
- 2026-10-03 Alias added: GHSA-m4m7-4cw8-62j6
References
Other 14
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-m4m7-4cw8-62j6
- https://github.com/DIRACGrid/DIRAC/commit/106f6efb40eb7318473fc09fc48083f1f864460a
- https://github.com/DIRACGrid/DIRAC/commit/55ecbd729242ddbe06251b57895873cc468f5a1a
- https://github.com/DIRACGrid/DIRAC/commit/5a5def88d65a18c77af9f2900ffb5866d6489d62
- https://github.com/DIRACGrid/DIRAC/commit/66cfc8bf1dc13a6d38bf0c5654d5b551d76dce9b
- https://github.com/DIRACGrid/DIRAC/commit/6f6fe65f27b6913916ef77a77a09918b94029c0a
- https://github.com/DIRACGrid/DIRAC/commit/fabf08a4a403fdd92d3445771528fa54b3ee902f
- https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79
- https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22
- https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10
- https://github.com/DIRACGrid/DIRAC
- https://pypi.org/project/DIRAC/8.0.79
- https://pypi.org/project/DIRAC/9.0.22
- https://pypi.org/project/DIRAC/9.1.10
More DIRACGrid vulnerabilities
- TI-2025-33911 DiracX-Web login page has Open Redirect vulnerability CVSS 3.1MEDIUM 4.7
- TI-2026-33328 DIRAC: RCE in RequestManager due to eval on untrusted input CVSS 3.1CRITICAL 9.9
- TI-2024-16342 TokenManager not checking permissions on cached tokens in DIRAC CVSS 3.1CRITICAL 9.1
- TI-2026-44155 DIRAC: Pilot code downloaded over unverified HTTPS connection CVSS 3.1HIGH 8.1
- TI-2024-19672 DIRAC: Unauthorized users can read proxy contents during generation CVSS 3.1HIGH 8.1
Sources
- CVE-2026-61667 · CVE Program
- CVE-2026-61667 · NVD
- FIRST EPSS
- GHSA-m4m7-4cw8-62j6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences