CVE-2026-61667 DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval
Authenticated attackers can exploit SQL injection to trigger code execution via eval, compromising the DIRAC system and exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61667?
CVE-2026-61667 is a critical SQL injection vulnerability in DIRACGrid DIRAC, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Which versions are affected by CVE-2026-61667?
7 open source packages ship an affected version, including dirac and DIRAC.
| Package | Affected | Fixed in |
|---|---|---|
dirac PyPI | From 6 | 8.0.79, 9.0.22, 9.1.10 |
dirac PyPI | From 6 | 8.0.79 |
dirac PyPI | From 8.1.0a1 | 9.0.22 |
dirac PyPI | From 9.1.0 | 9.1.10 |
DIRAC PyPI | From 6 | 8.0.79 |
DIRAC PyPI | From 8.1.0a1 | 9.0.22 |
1 more packages
DIRAC PyPI | From 9.1.0 | 9.1.10 |
How do I fix CVE-2026-61667?
Upgrade dirac to a fixed version for your release line: 8.0.79, 9.0.22 or 9.1.10.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-61667 being exploited?
There is no known exploitation of CVE-2026-61667 in the wild and no public exploit code.
Sources
Also known as GHSA-m4m7-4cw8-62j6, PYSEC-2026-3463.