Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.5, published 13 July 2026.

Which products and versions are affected?

DIRACGrid DIRAC >= 6, = 8.1.0a1, = 9.1.0, < 9.1.10.

Is there a fix for This vulnerability?

A patch was published on 2026-07-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

DIRAC SQL injection and improper access control in PilotManager

Q: Is there a fix for This vulnerability?

A patch was published on 2026-07-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: high · CVSS 8.5 · Published 2026-07-13

DIRAC, a software framework for distributed computing, contains security flaws in its PilotManager service. These flaws allow any authenticated user to view or delete computing jobs belonging to other users. Additionally, a database vulnerability could allow an attacker to manipulate or extract sensitive information from the system's database.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.5, published 13 July 2026.
Which products and versions are affected?: DIRACGrid DIRAC >= 6, < 8.0.79; DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22; DIRACGrid DIRAC >= 9.1.0, < 9.1.10.
Is there a fix for This vulnerability?: A patch was published on 2026-07-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The DIRAC PilotManager service suffers from two primary vulnerabilities: SQL injection (CWE-89) and improper access control (CWE-284). Several functions in PilotManagerHandler.py and PilotAgentsDB.py pass user-supplied parameters directly to the database layer without proper escaping or parameter substitution. Furthermore, the access control configuration for PilotManager is set to 'authenticated', which fails to enforce granular permissions, allowing any logged-in user to perform administrative actions like deleting or reading the output of any pilot job. Attackers can exploit these issues via network requests to modify or extract database records. The issues are resolved in versions 8.0.79, 9.0.22, and 9.1.10.

Affected products

DIRACGrid DIRAC >= 6, < 8.0.79
DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22
DIRACGrid DIRAC >= 9.1.0, < 9.1.10

Timeline

2026-07-13: advisory
2026-07-13: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.