Is CVE-2026-61668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-61668 being exploited in the wild.

How severe is CVE-2026-61668?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Which products and versions are affected?

DIRAC (PyPI) ECOSYSTEM:introduced=6.20.1,fixed=8.0.79, ECOSYSTEM:introduced=6.20.1,fixed=8.0.79,introduced=8.1.0a1,fixed=9.0.22,introduced=9.1.0,fixed=9.1.10.

Is there a fix for CVE-2026-61668?

Yes. DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-61668 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-61668?

Check whether you run DIRAC (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-61668: DIRAC improper certificate validation in PilotWrapper

CVE-2026-61668 · Severity: high · CVSS 8.1 · Published 2026-09-15

DIRAC, a software framework for distributed computing, contains a security flaw in how it downloads its core execution scripts. The system fails to verify the identity of the server providing these scripts, allowing a sophisticated attacker to intercept the connection and replace legitimate code with malicious software. If exploited, this could allow an attacker to gain control over computing resources and access sensitive credentials used within the grid network.

Technologies: DIRAC (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-61668 being exploited in the wild.
How severe is CVE-2026-61668?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: DIRAC (PyPI) ECOSYSTEM:introduced=6.20.1,fixed=8.0.79, ECOSYSTEM:introduced=6.20.1,fixed=8.0.79,introduced=8.1.0a1,fixed=9.0.22,introduced=9.1.0,fixed=9.1.10.
Is there a fix for CVE-2026-61668?: Yes. DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61668 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-61668?: Check whether you run DIRAC (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

DIRAC (PyPI): upgrade to 8.0.79, 9.1.10 or later
```
pip install "DIRAC>=9.1.10"
```

Technical details

The DIRAC PilotWrapper utility explicitly disables SSL certificate validation when downloading the second-stage pilot (pilot.tar) and its associated checksum file. This behavior was originally implemented to maintain compatibility with Python versions older than 2.7.9. An attacker capable of performing a man-in-the-middle (MITM) attack, such as through DNS spoofing or routing redirection at a grid site, can provide a malicious payload that the wrapper will execute with the privileges of the pilot process. This grants the attacker access to pilot proxies and credentials. The vulnerability is addressed in versions 8.0.79, 9.0.22, and 9.1.10 by enforcing validation against system and X509 certificate stores.

Affected products

DIRACGrid DIRAC >= 6.20.1, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10

Identifiers

CVE-2026-61668
GHSA-vg99-gr89-qhw9
PYSEC-2026-3464

Timeline

2026-07-13: advisory: GitHub Advisory GHSA-vg99-gr89-qhw9 published.
2026-07-13: patched: Patched versions 8.0.79, 9.0.22, and 9.1.10 released.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.