Executive brief
DIRAC, a software framework for distributed computing, contains a security flaw in how it downloads its core execution scripts. The system fails to verify the identity of the server providing these scripts, allowing a sophisticated attacker to intercept the connection and replace legitimate code with malicious software. If exploited, this could allow an attacker to gain control over computing resources and access sensitive credentials used within the grid network.
Technical details
The DIRAC PilotWrapper utility explicitly disables SSL certificate validation when downloading the second-stage pilot (pilot.tar) and its associated checksum file. This behavior was originally implemented to maintain compatibility with Python versions older than 2.7.9. An attacker capable of performing a man-in-the-middle (MITM) attack, such as through DNS spoofing or routing redirection at a grid site, can provide a malicious payload that the wrapper will execute with the privileges of the pilot process. This grants the attacker access to pilot proxies and credentials. The vulnerability is addressed in versions 8.0.79, 9.0.22, and 9.1.10 by enforcing validation against system and X509 certificate stores.
Affected products
- DIRACGrid DIRAC >= 6.20.1, < 8.0.79; >= 8.1.0a1, < 9.0.22; >= 9.1.0, < 9.1.10
Timeline
- 2026-07-13: advisory: GitHub Advisory GHSA-vg99-gr89-qhw9 published.
- 2026-07-13: patched: Patched versions 8.0.79, 9.0.22, and 9.1.10 released.