CVE-2026-61667: DIRAC Remote Code Execution Vulnerability via SQL Injection

dirac Updated 18 Jul 2026

Summary

13/07/2026

Disclosed on

CVE-2026-61667

CVE

Yes i

Fix available

Critical

Severity

9.9

CVSS Score

CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval. Affects dirac across 3 version ranges.

>= 6, < 8.0.79 >= 8.1.0a1, < 9.0.22 >= 9.1.0, < 9.1.10

Fixed in 8.0.79, 9.0.22 or 9.1.10, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

DIRAC is an open-source framework designed for managing distributed computing resources and workflows. It provides a comprehensive set of tools for data management, job scheduling, and monitoring. The FileCatalog component of DIRAC is responsible for managing datasets and their metadata. However, it has been found to contain a critical vulnerability that allows authenticated users to execute arbitrary code on the server due to improper handling of SQL queries.

Vulnerability Detail

The vulnerability arises from the FileCatalog DatasetManager's handling of SQL queries. Specifically, the checkDataset function directly passes user-controlled input to the database without proper escaping, leading to SQL injection. This malicious input can manipulate the SQL query, allowing an attacker to control the output that is subsequently passed to the eval function. The eval function executes the returned result as code, resulting in remote code execution. This vulnerability can lead to a complete compromise of the DIRAC system, allowing attackers to access sensitive configuration files, database credentials, and other critical data.

How To Fix

Latest published version: 9.1.21 as of 22 Oct 2026

pip install --upgrade "dirac==9.1.21"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 6, < 8.0.79 8.0.79
```
pip install --upgrade "dirac==8.0.79"
```
>= 8.1.0a1, < 9.0.22 9.0.22
```
pip install --upgrade "dirac==9.0.22"
```
>= 9.1.0, < 9.1.10 9.1.10
```
pip install --upgrade "dirac==9.1.10"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a temporary workaround, you can restrict access to the FileCatalog DatasetManager functions to only trusted users. However, this does not fully mitigate the risk and should not replace applying the patch.

Conclusion

The DIRAC framework has a critical vulnerability (CVE-2026-61667) that allows remote code execution through SQL injection. It is crucial for users to update to the patched versions of DIRAC to protect their systems from potential exploitation. Utilizing tools like Vulert can aid in ongoing vulnerability management.

See every vulnerability recorded for dirac →

FAQ

What is CVE-2026-61667?

CVE-2026-61667 is a critical vulnerability in the DIRAC framework that allows authenticated users to execute arbitrary code on the server through SQL injection.

How can I tell if my DIRAC installation is affected?

You can check your DIRAC version against the patched versions (8.0.79, 9.0.22, 9.1.10). Additionally, you can use Vulert to monitor and alert for vulnerabilities in your software.

What are the potential impacts of this vulnerability?

An attacker can gain full control over the DIRAC system, access sensitive information, and potentially remove evidence of their actions from logs.

Is there a way to mitigate this vulnerability without updating?

While restricting access to the affected functions can help, it is not a complete solution. Updating to a patched version is strongly recommended.

How does Vulert help in monitoring vulnerabilities?

Vulert uses the Pipfile.lock to monitor open-source vulnerabilities in real-time, allowing you to check if your application is affected without requiring code access or installation.

References

Related vulnerabilities

Recent vulnerabilities recorded for dirac.

View all dirac vulnerabilities →

How To Fix

Latest published version: 9.1.21 as of 22 Oct 2026

pip install --upgrade "dirac==9.1.21"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 6, < 8.0.79 8.0.79
```
pip install --upgrade "dirac==8.0.79"
```
>= 8.1.0a1, < 9.0.22 9.0.22
```
pip install --upgrade "dirac==9.0.22"
```
>= 9.1.0, < 9.1.10 9.1.10
```
pip install --upgrade "dirac==9.1.10"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram

Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.

Join the channel →