CVE-2026-61668High· 8.1▾ TwilightDIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to dow…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 17.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
DIRAC >= 6.20.1, < 8.0.79DIRAC >= 8.1.0a1, < 9.0.22DIRAC >= 9.1.0, < 9.1.10Patched in:
DIRAC 8.0.79DIRAC 9.0.22DIRAC 9.1.10Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61667Critical· 9.9DIRAC is an interware, meaning a software framework for distributed computing
CVE-2026-45579Critical· 9.9DIRAC is an interware, meaning a software framework for distributed computing
GHSA-7xw9-549r-8jrcHigh· 8.5DIRAC: SQL injection and lack of access control in PilotManager service
CVE-2024-24825Critical· 9.1DIRAC's TokenManager does not check permissions on cached tokens
CVE-2024-29905High· 8.1DIRAC: Unauthorized users can read proxy contents during generation
CVE-2026-24281High· 7.4Hostname verification in Apache ZooKeeper ZKTrustManager falls back to reverse DNS (PTR) when IP SAN validation fails, allowing attackers who control or spoof PTR records to impersonate ZooKeeper servers or clients with a valid certifica…