Read the docs
TI-2026-44155 Aliases CVE-2026-61668GHSA-vg99-gr89-qhw9

DIRAC: Pilot code downloaded over unverified HTTPS connection

Priority LOW 37CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00396 34th percentileScored 2026-11-07
Fix Fixed DIRAC (DIRACGrid): 8.0.79, 9.0.22, 9.1.10DIRAC (PyPI): 8.0.79, 9.0.22, 9.1.10

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DIRACGridDIRAC6.20.1 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.108.0.79, 9.0.22, 9.1.10Patch availableCNA
—DIRAC (PyPI)6.20.1 to before 8.0.798.0.79Patch availableGHSA-vg99-gr89-qhw9
—DIRAC (PyPI)8.1.0a1 to before 9.0.229.0.22Patch availableGHSA-vg99-gr89-qhw9
—DIRAC (PyPI)9.1.0 to before 9.1.109.1.10Patch availableGHSA-vg99-gr89-qhw9
  • DIRAC VendorDIRACGrid Affected 6.20.1 to before 8.0.79; 9.0.0a1 to before 9.0.22; 9.1.0 to before 9.1.10 Fixed in 8.0.79, 9.0.22, 9.1.10 Patch available CNA
  • DIRAC (PyPI) Vendor— Affected 6.20.1 to before 8.0.79 Fixed in 8.0.79 Patch available GHSA-vg99-gr89-qhw9
  • DIRAC (PyPI) Vendor— Affected 8.1.0a1 to before 9.0.22 Fixed in 9.0.22 Patch available GHSA-vg99-gr89-qhw9
  • DIRAC (PyPI) Vendor— Affected 9.1.0 to before 9.1.10 Fixed in 9.1.10 Patch available GHSA-vg99-gr89-qhw9

Remediation

  • Fix · CNA DIRAC (DIRACGrid) Fixed in 8.0.79, 9.0.22, 9.1.10
  • Fix · GHSA-vg99-gr89-qhw9 DIRAC (PyPI) Fixed in 8.0.79 Advisory →
  • Fix · GHSA-vg99-gr89-qhw9 DIRAC (PyPI) Fixed in 9.0.22 Advisory →
  • Fix · GHSA-vg99-gr89-qhw9 DIRAC (PyPI) Fixed in 9.1.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61668
  2. 2026-10-03 Alias added: GHSA-vg99-gr89-qhw9

References

Other 11

  • TI-2025-33911 DiracX-Web login page has Open Redirect vulnerability CVSS 3.1MEDIUM 4.7
  • TI-2026-44154 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval CVSS 3.1CRITICAL 9.9
  • TI-2026-33328 DIRAC: RCE in RequestManager due to eval on untrusted input CVSS 3.1CRITICAL 9.9
  • TI-2024-16342 TokenManager not checking permissions on cached tokens in DIRAC CVSS 3.1CRITICAL 9.1
  • TI-2024-19672 DIRAC: Unauthorized users can read proxy contents during generation CVSS 3.1HIGH 8.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences