CVE-2026-61668 Details
Description
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
A vulnerability exists in the DIRAC software framework for distributed computing, specifically in the Workload Management System's PilotWrapper.py script. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the pilotWrapperScript function downloaded a critical archive, pilot.tar, over HTTPS without verifying the server's SSL certificate. This flaw enabled an attacker to intercept or redirect network traffic, potentially replacing the downloaded pilot code and its checksum with malicious alternatives. As a result, arbitrary code could be executed in the pilot's context, accessing sensitive proxy credentials. The vulnerability has been addressed by implementing proper SSL certificate validation through system trust and designated certificate directories.
Users can upgrade to DIRAC versions 8.0.79, 9.0.22, or 9.1.10 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 15, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DIRACGrid/DIRAC/commit/68029dfb5ddd8b1e4106851f8e37370aa80ac7ae | [email protected] | Source CodeVendor |
| https://github.com/DIRACGrid/DIRAC/commit/92e2e26c63b964b8499bee5e9c2e2821a36eac56 | [email protected] | Source CodeVendor |
| https://github.com/DIRACGrid/DIRAC/commit/b332c437d064f66ee46f5b45a90a9f7c4bace38d | [email protected] | Source CodeVendor |
| https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79 | [email protected] | Release NotesVendor |
| https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22 | [email protected] | Release NotesVendor |
| https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10 | [email protected] | Release NotesVendor |
| https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| DIRAC | >= 6.20.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 15, 2026 | New CVE Received | [email protected] |