# DIRAC SQL injection and improper access control in PilotManager

Source: https://junglewise.ai/threats/dirac-sql-injection-and-improper-access-control-in-pilotmanager-07e5a6bf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-13. Updated: 2026-07-13  
License: CC BY 4.0 with a link back

Severity: high · CVSS 8.5 · Published 2026-07-13

DIRAC, a software framework for distributed computing, contains security flaws in its PilotManager service. These flaws allow any authenticated user to view or delete computing jobs belonging to other users. Additionally, a database vulnerability could allow an attacker to manipulate or extract sensitive information from the system's database.

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 8.5, published 13 July 2026.

**Which products and versions are affected?** DIRACGrid DIRAC >= 6, < 8.0.79; DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22; DIRACGrid DIRAC >= 9.1.0, < 9.1.10.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-13. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The DIRAC PilotManager service suffers from two primary vulnerabilities: SQL injection (CWE-89) and improper access control (CWE-284). Several functions in PilotManagerHandler.py and PilotAgentsDB.py pass user-supplied parameters directly to the database layer without proper escaping or parameter substitution. Furthermore, the access control configuration for PilotManager is set to 'authenticated', which fails to enforce granular permissions, allowing any logged-in user to perform administrative actions like deleting or reading the output of any pilot job. Attackers can exploit these issues via network requests to modify or extract database records. The issues are resolved in versions 8.0.79, 9.0.22, and 9.1.10.

## Affected products

- DIRACGrid DIRAC >= 6, < 8.0.79
- DIRACGrid DIRAC >= 8.1.0a1, < 9.0.22
- DIRACGrid DIRAC >= 9.1.0, < 9.1.10

## Timeline

- 2026-07-13: advisory
- 2026-07-13: patched

## References

- [https://api.github.com/users/sfayer](https://api.github.com/users/sfayer)
- [https://github.com/sfayer](https://github.com/sfayer)
- [https://api.github.com/users/sfayer/gists%7B/gist_id%7D](https://api.github.com/users/sfayer/gists%7B/gist_id%7D)
- [https://api.github.com/users/sfayer/repos](https://api.github.com/users/sfayer/repos)
- [https://avatars.githubusercontent.com/u/3957716?v=4](https://avatars.githubusercontent.com/u/3957716?v=4)
- [https://api.github.com/users/sfayer/events%7B/privacy%7D](https://api.github.com/users/sfayer/events%7B/privacy%7D)