CVE-2026-45579Critical· 9.9▾ MidnightDIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authent…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
DIRAC >= 6, < 8.0.79DIRAC >= 8.1.0a1, < 9.0.22DIRAC >= 9.1.0, < 9.1.10Patched in:
DIRAC 8.0.79DIRAC 9.0.22DIRAC 9.1.10Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61667Critical· 9.9DIRAC is an interware, meaning a software framework for distributed computing
CVE-2026-61668High· 8.1DIRAC is an interware, meaning a software framework for distributed computing
GHSA-7xw9-549r-8jrcHigh· 8.5DIRAC: SQL injection and lack of access control in PilotManager service
CVE-2024-24825Critical· 9.1DIRAC's TokenManager does not check permissions on cached tokens
CVE-2024-29905High· 8.1DIRAC: Unauthorized users can read proxy contents during generation
CVE-2025-53837Critical· 9.9XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc)