Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.1
CVE-2026-61668: DIRAC downloads pilot code without certificate verification
CVE-2026-61668 · published 1 month ago
Summary
DIRAC versions before 8.0.79, 9.0.22 and 9.1.10 fetch important pilot files over HTTPS without confirming the server’s identity. If an attacker can redirect the network traffic, they could replace those files and run their own code, potentially accessing sensitive credentials. Upgrade to the fixed versions or apply the provided patch to ensure the download is securely validated.
What to do
- Update dirac to version 8.0.79.
- Update dirac to version 9.0.22.
- Update dirac to version 9.1.10.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | diracgrid | dirac | >= 6.20.1, < 8.0.79 |
| pip | – | dirac |
>= 6.20.1, < 8.0.79 >= 8.1.0a1, < 9.0.22 >= 9.1.0, < 9.1.10 Fix: upgrade to 8.0.79
|
Original advisory text
DIRAC: Pilot code downloaded over unverified HTTPS connection
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
References
- https://pypi.org/project/DIRAC/8.0.79
- https://pypi.org/project/DIRAC/9.0.22
- https://pypi.org/project/DIRAC/9.1.10
- https://github.com/advisories/GHSA-vg99-gr89-qhw9
- https://github.com/DIRACGrid/DIRAC Product
- https://pypi.org/project/dirac Product
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61668... Vendor Advisory
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-61668 Vendor Advisory
- https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79 URL
- https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22 URL
- https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10 URL
- https://github.com/DIRACGrid/DIRAC/commit/68029dfb5ddd8b1e4106851f8e37370aa80ac7... Patch
- https://github.com/DIRACGrid/DIRAC/commit/92e2e26c63b964b8499bee5e9c2e2821a36eac... Patch
- https://github.com/DIRACGrid/DIRAC/commit/b332c437d064f66ee46f5b45a90a9f7c4bace3... Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-295Improper Certificate Validation
Timeline
Published15 Sep 2026
Updated4 Nov 2026
First seen13 Jul 2026
Sources
GHSA-vg99-gr89-qhw9 · GHSA
CVE-2026-61668 · NVD
PYSEC-2026-3464 · OSV
CVE-2026-61668 · MITRE
CVE-2026-61668 · OSV
Track software like this
Free during beta