CVE-2024-24825: DIRAC Token Exposure Vulnerability
Summary
CVE-2024-24825: DIRAC is a distributed resource framework. Affects dirac across 2 version ranges.
< 8.0.37
< f9ddab755b9a69acb85e14d2db851d8ac0c9648c
Fixed in f9ddab755b9a69acb85e14d2db851d8ac0c9648c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
DIRAC is a distributed resource framework designed to facilitate the management of computing resources across various environments. It allows users to submit jobs, manage data, and access resources efficiently. However, certain versions of DIRAC are vulnerable to a security flaw that permits unauthorized users to access tokens requested by other users or agents, potentially exposing sensitive resources.
Vulnerability Detail
The vulnerability arises from improper handling of user tokens within DIRAC. In affected versions, any user can obtain a token that has been requested by another user or agent. This flaw can lead to unauthorized access to resources, compromising the integrity and confidentiality of the system. The issue has been identified in versions prior to 8.0.37, and it poses a significant risk as it allows unintended parties to access sensitive data and resources.
How To Fix
Latest published version: 9.1.21 as of 22 Oct 2026
pip install --upgrade "dirac==9.1.21"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
f9ddab755b9a69acb85e14d2db851d8ac0c9648c
This is the first release that contains the fix.
pip install --upgrade "dirac==f9ddab755b9a69acb85e14d2db851d8ac0c9648c"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to upgrade to the fixed version.
Conclusion
The DIRAC token exposure vulnerability (CVE-2024-24825) poses a significant risk to users by allowing unauthorized access to sensitive resources. It is crucial for users to upgrade to version 8.0.37 or later to mitigate this risk. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain the security of your applications.
See every vulnerability recorded for dirac →
FAQ
CVE-2024-24825 is a security vulnerability in DIRAC that allows unauthorized users to access tokens requested by other users, potentially exposing sensitive resources.
All versions of DIRAC prior to 8.0.37 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Unfortunately, there are no workarounds available for this vulnerability. It is strongly recommended to upgrade to the patched version as soon as possible.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for dirac.
