CVE-2026-61668

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Scoring

Severity

HIGH

CVSS base score

8.1

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS probability

0.24%

CWE

CWE-295

Published

2026-09-15

Last modified

2026-09-17

Affected products

• DIRACGrid DIRAC
• DIRACGrid DIRAC
• DIRACGrid DIRAC

Weakness type

• CWE-295

Related vulnerabilities

• CVE-2026-87608 — Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging so
• CVE-2026-66795 — Managedcluster-import-controller: csr auto-approver does not validate certificate subject or signername (spoke→hub cluster-admin)
• CVE-2026-78234 — Hawtio-operator: hawtio-operator: service-ca signing oracle allows arbitrary-cn certificate issuance to namespace edit users
• CVE-2026-85102 — Improper Certificate Validation in Quantum Security Gateway
• CVE-2026-32253 — Sunshine: Authentication bypass via improper client certificate validation
• CVE-2026-16835 — Power System Improper Certificate Validation
• CVE-2026-82180 — In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication polic
• CVE-2026-22093 — Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

Markdown version · Browse all CVEs