CVE-2026-61668 in DIRAC
Summary
by MITRE • 09/15/2026
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
DIRAC serves as a critical interware framework designed to facilitate distributed computing across various scientific and industrial domains, particularly within the high-energy physics community where it manages complex workflows and resource allocation. The security integrity of such systems is paramount because they often handle sensitive data and execute privileged operations on behalf of users or automated processes. A significant vulnerability was identified in the WorkloadManagementSystem/Utilities/PilotWrapper.py component prior to versions 8.0.79, 9.0.22, and 9.1.10. This specific module is responsible for initializing pilot jobs, which are lightweight agents that execute tasks on remote computing resources. The flaw lies in the method used by the pilot wrapper script to retrieve its second-stage payload, specifically the pilot.tar archive containing the actual execution logic, as well as the reference checksum file intended to verify the integrity of this download.
The technical root cause of this vulnerability is the use of ssl._create_unverified_context within Python's standard library when establishing connections for downloading these critical files. By explicitly creating an SSL context that does not perform certificate verification, the application effectively disables Transport Layer Security (TLS) authentication mechanisms. This configuration allows the client to accept any server-provided certificate without validating it against a trusted root authority or checking if the hostname matches the certificate subject. Consequently, the communication channel used for downloading both the executable code and its integrity checksum is entirely unauthenticated and unprotected against man-in-the-middle attacks. An adversary capable of intercepting network traffic at the grid site level through DNS spoofing, routing manipulation, or other network-level interception techniques can position themselves between the pilot wrapper script and the remote repository hosting these files.
The operational impact of this flaw is severe due to the elevated privileges typically held by pilot jobs within a computing infrastructure. Since an attacker can substitute both the malicious payload in place of the legitimate pilot.tar archive and forge or manipulate the checksum file, they can bypass integrity checks that might otherwise rely on local validation if implemented correctly. The downloaded code executes with the same permissions as the original pilot process, which often includes access to proxy credentials used for authenticating further interactions with grid resources. This grants an attacker arbitrary code execution capabilities within a privileged context, potentially leading to unauthorized data exfiltration, lateral movement across the distributed computing environment, or disruption of critical scientific workflows. The ability to manipulate the checksum ensures that even if basic file integrity checks are performed locally after download, they will pass because the attacker provides a matching hash for their malicious payload.
This vulnerability aligns with CWE-295 Improper Certificate Validation and CWE-319 Cleartext Transmission of Sensitive Information within an Unprotected Communication Channel from the Common Weakness Enumeration standard. From a tactical perspective, it maps to MITRE ATT&CK techniques such as T1078 Valid Accounts for credential misuse and potentially T1499 Endpoint Denial of Service if the malicious code disrupts services. The exploitation vector relies heavily on network-level interception, highlighting risks associated with untrusted networks or compromised routing infrastructure common in large-scale distributed computing environments where multiple administrative domains interact.
The issue has been remediated in DIRAC versions 8.0.79, 9.0.22, and 9.1.10 by modifying the SSL context creation to enforce strict certificate verification against system trust stores or specific grid certificate directories defined via X509_CERT_DIR environment variables. This ensures that only servers presenting certificates signed by trusted authorities are accepted during the download process. Organizations running affected versions should prioritize upgrading immediately to eliminate this attack surface. In addition to patching, administrators should audit their network security controls to prevent DNS spoofing and routing manipulation attacks at the grid site level. Implementing mutual TLS authentication for internal service communications and regularly verifying certificate validity periods can further harden the infrastructure against similar interception-based threats in distributed computing environments.