PT-2026-60112 · Dirac · Dirac

CVE-2026-61668 · Published 2026-07-13 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.79 DIRAC versions prior to 9.0.22 DIRAC versions prior to 9.1.10

Description The initial wrapper script downloads the second stage pilot (pilot.tar) and executes the contained script without verifying the web server's SSL certificate. Although a checksum is tested, the reference checksum file is downloaded via the same unvalidated channel. This lack of verification allows a man-in-the-middle attack to alter the second stage pilot code, potentially leading to the execution of arbitrary code within the pilot context, granting access to pilot proxies and credentials.

Recommendations Update to version 8.0.79 or later. Update to version 9.0.22 or later. Update to version 9.1.10 or later.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-61668

GHSA-VG99-GR89-QHW9

PYSEC-2026-3464

Affected Products

Dirac

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-61668 · Security Note
• https://osv.dev/vulnerability/GHSA-vg99-gr89-qhw9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-3464 · Vendor Advisory
• https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9 · Note
• https://github.com/DIRACGrid/DIRAC · Note
• https://pypi.org/project/DIRAC/8.0.79 · Note
• https://pypi.org/project/DIRAC/9.1.10 · Note
• https://github.com/advisories/GHSA-vg99-gr89-qhw9 · Note
• https://pypi.org/project/DIRAC/9.0.22 · Note
• https://pypi.org/project/dirac · Note