CVE-2026-61667

CRITICAL 9.9

DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

CWE	CWE-89 CWE-95
Vendor	diracgrid
Product	dirac
Published	Sep 15, 2026
Last Updated	Sep 15, 2026

Stay Ahead of the Next One

Get instant alerts for diracgrid dirac

Be the first to know when new critical vulnerabilities affecting diracgrid dirac are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

DIRACGrid / DIRAC

>= 6r0, < 8.0.79 >= 9.0.0a1, < 9.0.22 >= 9.1.0, < 9.1.10

References

NVD ↗ CVE.org ↗ EPSS Data ↗