Is CVE-2026-61667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61667 being exploited in the wild.

How severe is CVE-2026-61667?

Critical severity, with a CVSS score of 9.9, published 15 September 2026.

Which products and versions are affected?

DIRAC (PyPI) ECOSYSTEM:introduced=6,fixed=8.0.79, ECOSYSTEM:introduced=6,fixed=8.0.79,introduced=8.1.0a1,fixed=9.0.22,introduced=9.1.0,fixed=9.1.10.

Is there a fix for CVE-2026-61667?

Yes. DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61667 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61667?

Check whether you run DIRAC (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61667: DIRAC remote code execution in FileCatalog DatasetManager

CVE-2026-61667 · Severity: critical · CVSS 9.9 · Published 2026-09-15

DIRAC, a software framework for distributed computing, is vulnerable to a critical security flaw in its FileCatalog component. An authenticated user can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full system compromise. This could allow attackers to steal database passwords, access sensitive configuration files, and export security tokens, while also providing a way to delete logs to hide their activity.

Technologies: DIRAC (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61667 being exploited in the wild.
How severe is CVE-2026-61667?: Critical severity, with a CVSS score of 9.9, published 15 September 2026.
Which products and versions are affected?: DIRAC (PyPI) ECOSYSTEM:introduced=6,fixed=8.0.79, ECOSYSTEM:introduced=6,fixed=8.0.79,introduced=8.1.0a1,fixed=9.0.22,introduced=9.1.0,fixed=9.1.10.
Is there a fix for CVE-2026-61667?: Yes. DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61667 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61667?: Check whether you run DIRAC (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later
```
pip install "DIRAC>=9.1.10"
```

Technical details

A vulnerability exists in the DIRAC FileCatalog DatasetManager where the checkDataset function passes unvalidated arguments to the backend database handler. The __checkDataset function uses Python f-strings to construct SQL queries without proper escaping, leading to SQL injection (CWE-89). Because the results of these queries are subsequently passed to the eval() function (CWE-95), an authenticated attacker can control the input to eval() via the SQL injection, resulting in remote code execution. The exploit allows for full compromise of the DIRAC system, including access to dirac.cfg and stored credentials. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.

Affected products

DIRACGrid DIRAC >= 6, < 8.0.79
DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22
DIRACGrid DIRAC >= 9.1.0, < 9.1.10

Identifiers

CVE-2026-61667
GHSA-m4m7-4cw8-62j6
PYSEC-2026-3463

Timeline

2026-07-13: advisory
2026-07-13: disclosed
2026-07-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.