CVE-2026-61668: DIRAC Package Vulnerability Due to Unverified HTTPS Connection
Summary
CVE-2026-61668: DIRAC: Pilot code downloaded over unverified HTTPS connection. Affects dirac across 3 version ranges.
>= 6.20.1, < 8.0.79
>= 8.1.0a1, < 9.0.22
>= 9.1.0, < 9.1.10
Fixed in 8.0.79, 9.0.22 or 9.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
DIRAC is a flexible and powerful framework designed for managing and executing distributed computing tasks across various grid infrastructures. It provides a comprehensive set of tools for workload management, job submission, and monitoring. However, a significant vulnerability exists in its pilot code downloading mechanism, which compromises the integrity and security of the system.
Vulnerability Detail
The vulnerability arises from the second stage pilot (pilot.tar) being downloaded by the initial wrapper script without verifying the SSL certificate of the web server. This lack of SSL validation, which is disabled to maintain compatibility with older Python versions, allows for potential man-in-the-middle attacks. An attacker could intercept the download and alter the pilot code, leading to arbitrary code execution within the pilot context, which could compromise sensitive credentials and proxies.
How To Fix
Latest published version: 9.1.21 as of 22 Oct 2026
pip install --upgrade "dirac==9.1.21"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 6.20.1, < 8.0.798.0.79pip install --upgrade "dirac==8.0.79" -
>= 8.1.0a1, < 9.0.229.0.22pip install --upgrade "dirac==9.0.22" -
>= 9.1.0, < 9.1.109.1.10pip install --upgrade "dirac==9.1.10"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can manually verify the SSL certificate of the web server before executing the pilot code. However, this is not a recommended long-term solution. It is best to update to the patched versions as soon as possible.
Conclusion
The DIRAC package has a critical vulnerability that allows for unverified downloading of pilot code, posing significant security risks. It is essential to update to the patched versions to mitigate these risks and ensure the integrity of your applications.
See every vulnerability recorded for dirac →
FAQ
CVE-2026-61668 is a vulnerability in the DIRAC package that allows for unverified downloading of pilot code, potentially leading to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The main risk is a man-in-the-middle attack where an attacker could alter the downloaded pilot code, leading to unauthorized access and execution of malicious code.
You can update the DIRAC package by running 'pip install --upgrade dirac' in your terminal.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dirac.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
