DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval (CVE-2026-61667)
DIRAC's FileCatalog DatasetManager contains an SQL injection vulnerability in the checkDataset function, which constructs database queries using unescaped f-strings. The query result is then passed directly to eval, enabling authenticated users to execute arbitrary code on the server. This vulnerability allows full system compromise, including access to sensitive configuration files, database credentials, and stored tokens. The issue affects DIRAC versions from 6 up to but not including 8.0.79, and versions from 9.1.0 up to but not including 9.1.10. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.
AI Analysis
Technical Summary
The FileCatalog DatasetManager in DIRAC improperly constructs SQL queries using unescaped f-strings, leading to SQL injection. The injected SQL result is passed to eval without sanitization, resulting in remote code execution for authenticated users. This flaw allows attackers to execute arbitrary commands on the server, compromising the entire DIRAC system. Multiple functions in the same module exhibit similar patterns and may be vulnerable. The vulnerability is tracked as CVE-2026-61667 and has been fixed in DIRAC versions 8.0.79, 9.0.22, and 9.1.10.
Potential Impact
Authenticated users can exploit this vulnerability to execute arbitrary code on the DIRAC server, leading to full system compromise. Attackers can access sensitive files such as dirac.cfg, extract database passwords, and export stored proxies and tokens. They can also potentially erase logs to cover their tracks, severely impacting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
A fix is available. Users should upgrade DIRAC to versions 8.0.79, 9.0.22, or 9.1.10 or later. Applying these patches will remediate the SQL injection and remote code execution vulnerabilities in the FileCatalog DatasetManager. No additional mitigation steps are indicated by the vendor advisory.
DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval (CVE-2026-61667)
Description
DIRAC's FileCatalog DatasetManager contains an SQL injection vulnerability in the checkDataset function, which constructs database queries using unescaped f-strings. The query result is then passed directly to eval, enabling authenticated users to execute arbitrary code on the server. This vulnerability allows full system compromise, including access to sensitive configuration files, database credentials, and stored tokens. The issue affects DIRAC versions from 6 up to but not including 8.0.79, and versions from 9.1.0 up to but not including 9.1.10. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.
CVSS v3.1
Score 9.9critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The FileCatalog DatasetManager in DIRAC improperly constructs SQL queries using unescaped f-strings, leading to SQL injection. The injected SQL result is passed to eval without sanitization, resulting in remote code execution for authenticated users. This flaw allows attackers to execute arbitrary commands on the server, compromising the entire DIRAC system. Multiple functions in the same module exhibit similar patterns and may be vulnerable. The vulnerability is tracked as CVE-2026-61667 and has been fixed in DIRAC versions 8.0.79, 9.0.22, and 9.1.10.
Potential Impact
Authenticated users can exploit this vulnerability to execute arbitrary code on the DIRAC server, leading to full system compromise. Attackers can access sensitive files such as dirac.cfg, extract database passwords, and export stored proxies and tokens. They can also potentially erase logs to cover their tracks, severely impacting confidentiality, integrity, and availability of the system.
Mitigation Recommendations
A fix is available. Users should upgrade DIRAC to versions 8.0.79, 9.0.22, or 9.1.10 or later. Applying these patches will remediate the SQL injection and remote code execution vulnerabilities in the FileCatalog DatasetManager. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m4m7-4cw8-62j6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-61667"]
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a55ffa968715ace432fa01f
Added to database: 07/14/2026, 09:21:45 UTC
Last enriched: 07/14/2026, 09:55:42 UTC
Last updated: 07/31/2026, 12:27:30 UTC
Views: 60
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.