CVE-2026-61667Critical· 9.9▾ MidnightDIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled data…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 54.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.7%
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
DIRAC >= 6, < 8.0.79DIRAC >= 8.1.0a1, < 9.0.22DIRAC >= 9.1.0, < 9.1.10Patched in:
DIRAC 8.0.79DIRAC 9.0.22DIRAC 9.1.10Connected by shared product, vendor, weakness, or advisory.
CVE-2026-45579Critical· 9.9DIRAC is an interware, meaning a software framework for distributed computing
GHSA-7xw9-549r-8jrcHigh· 8.5DIRAC: SQL injection and lack of access control in PilotManager service
CVE-2026-61668High· 8.1DIRAC is an interware, meaning a software framework for distributed computing
CVE-2024-24825Critical· 9.1DIRAC's TokenManager does not check permissions on cached tokens
CVE-2024-29905High· 8.1DIRAC: Unauthorized users can read proxy contents during generation
CVE-2025-13811Medium· 6.3A vulnerability was determined in jsnjfz WebStack-Guns 1.0