DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted input (CVE-2026-45579)
Affects DIRACSource GCVE Database
Not known to be exploited · CVSS 9.9 Critical · fixed in 8.0.79 : patch DIRAC as a priority.
Data as of 10/24/2026, 17:08:25 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.8% chance of exploitation in 30 days – higher than 58% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 8.0.79, 9.0.22, 9.1.10
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIDIRAC | Affected
| Fixed in
|
| PyPIDIRAC | Affected
| Fixed in
|
| PyPIDIRAC | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and has been released in DIRAC versions 8.0.79, 9.0.22, and 9.1.10. Users should upgrade to these fixed versions to remediate the vulnerability. No additional mitigations are specified by the vendor advisory.
Description
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Impact
Exploitation of this vulnerability can lead to remote code execution on the DIRAC server with the privileges of the DIRAC service account. Attackers can access sensitive files such as dirac.cfg, database passwords, stored proxies, and tokens. They can also alter local log files to cover their tracks, resulting in full compromise of the DIRAC system's confidentiality, integrity, and availability.
Summary
The vulnerability in DIRAC's RequestManagementSystem involves the export_getRequestCountersWeb function passing a user-controlled groupingAttribute to getRequestCountersWeb, which evaluates unrecognized values as Python code. This unsafe eval allows an attacker with authenticated access to execute arbitrary commands with the privileges of the DIRAC service account. Successful exploitation can disclose sensitive configuration and credential data and enable full system compromise. The issue is tracked as CVE-2026-45579 and is fixed in versions 8.0.79, 9.0.22, and 9.1.10.