# CVE-2026-61667: DIRAC remote code execution in FileCatalog DatasetManager

Source: https://junglewise.ai/threats/cve-2026-61667-dirac-remote-code-execution-in-filecatalog-datasetmanager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

CVE-2026-61667 · Severity: critical · CVSS 9.9 · Published 2026-09-15

DIRAC, a software framework for distributed computing, is vulnerable to a critical security flaw in its FileCatalog component. An authenticated user can exploit this vulnerability to execute arbitrary commands on the server, potentially leading to a full system compromise. This could allow attackers to steal database passwords, access sensitive configuration files, and export security tokens, while also providing a way to delete logs to hide their activity.

Technologies: [DIRAC (PyPI)](https://junglewise.ai/threats/technologies/dirac). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61667 being exploited in the wild.

**How severe is CVE-2026-61667?** Critical severity, with a CVSS score of 9.9, published 15 September 2026.

**Which products and versions are affected?** DIRAC (PyPI) ECOSYSTEM:introduced=6,fixed=8.0.79, ECOSYSTEM:introduced=6,fixed=8.0.79,introduced=8.1.0a1,fixed=9.0.22,introduced=9.1.0,fixed=9.1.10.

**Is there a fix for CVE-2026-61667?** Yes. DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61667 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61667?** Check whether you run DIRAC (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later

  ```sh
  pip install "DIRAC>=9.1.10"
  ```


## Technical details

A vulnerability exists in the DIRAC FileCatalog DatasetManager where the checkDataset function passes unvalidated arguments to the backend database handler. The __checkDataset function uses Python f-strings to construct SQL queries without proper escaping, leading to SQL injection (CWE-89). Because the results of these queries are subsequently passed to the eval() function (CWE-95), an authenticated attacker can control the input to eval() via the SQL injection, resulting in remote code execution. The exploit allows for full compromise of the DIRAC system, including access to dirac.cfg and stored credentials. Patches are available in versions 8.0.79, 9.0.22, and 9.1.10.

## Affected products

- DIRACGrid DIRAC >= 6, < 8.0.79
- DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22
- DIRACGrid DIRAC >= 9.1.0, < 9.1.10

## Identifiers

- CVE-2026-61667
- GHSA-m4m7-4cw8-62j6
- PYSEC-2026-3463

## Timeline

- 2026-07-13: advisory
- 2026-07-13: disclosed
- 2026-07-13: patched

## References

- [https://api.github.com/users/sfayer](https://api.github.com/users/sfayer)
- [https://github.com/sfayer](https://github.com/sfayer)
- [https://api.github.com/users/sfayer/gists%7B/gist_id%7D](https://api.github.com/users/sfayer/gists%7B/gist_id%7D)
- [https://api.github.com/users/sfayer/repos](https://api.github.com/users/sfayer/repos)
- [https://avatars.githubusercontent.com/u/3957716?v=4](https://avatars.githubusercontent.com/u/3957716?v=4)
- [https://api.github.com/users/sfayer/events%7B/privacy%7D](https://api.github.com/users/sfayer/events%7B/privacy%7D)

## Related threats

- [DIRAC improper certificate validation in PilotWrapper](https://junglewise.ai/threats/cve-2026-61668-dirac-improper-certificate-validation-in-pilotwrapper)
- [DIRAC RCE via eval injection in RequestManager](https://junglewise.ai/threats/cve-2026-45579-dirac-rce-via-eval-injection-in-requestmanager)
- [PYSEC-2026-1295 - DIRAC: Unauthorized users can read proxy contents during generation](https://junglewise.ai/threats/cve-2024-29905-dirac-unauthorized-users-can-read-proxy-contents-during)
- [DIRAC's TokenManager does not check permissions on cached tokens](https://junglewise.ai/threats/cve-2024-24825-dirac-s-tokenmanager-does-not-check-permissions-on-cached-tokens)