CVE-2026-61668
HighCVSS 8.1Summary
DIRAC's PilotWrapper.py downloads the second-stage pilot.tar archive and its reference checksum without TLS certificate verification, using ssl._create_unverified_context. An attacker able to redirect or intercept network traffic (e.g., via DNS or routing manipulation) can substitute both the pilot code and its checksum, leading to arbitrary code execution with access to pilot proxy credentials. Fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Risk Assessment
An attacker capable of intercepting network traffic can execute arbitrary code in the pilot context and access proxy credentials, potentially compromising grid infrastructure. The risk is high in distributed environments where inter-site traffic is not fully trusted.
Recommendation
Upgrade DIRAC to version 8.0.79, 9.0.22, or 9.1.10, where the server certificate is validated through system trust and X509_CERT_DIR or the grid certificate directory. Until patched, consider restricting the ability to manipulate network traffic to pilot-downloading servers.
Other vulnerabilities in DIRAC
See all- CVE-2026-61667Critical
In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the checkDataset function in FileCatalogHandler.py forwards an authenticated caller-controlled datasets value to __checkDataset in DatasetManager.py, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution.
- CVE-2026-45579Critical
In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the export_getRequestCountersWeb function in ReqManagerHandler.py passes an authenticated caller-controlled groupingAttribute to getRequestCountersWeb in RequestDB.py. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands.
Original NVD description (English source)
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.