CVE-2026-45579 Overview
CVE-2026-45579 is a code injection vulnerability [CWE-95] in DIRAC, an interware framework for distributed computing used in scientific grid environments. The flaw resides in the RequestManagementSystem/Service/ReqManagerHandler.pyexport_getRequestCountersWeb function, which passes an authenticated caller-controlled groupingAttribute parameter to RequestManagementSystem/DB/RequestDB.pygetRequestCountersWeb. An unrecognized value is evaluated as Python code against the Request object, allowing crafted dunder attribute expressions to reach operating-system functions. Any authenticated user with low privileges can execute arbitrary commands as the DIRAC service account. Maintainers fixed the issue in versions 8.0.79, 9.0.22, and 9.1.10.
Critical Impact
Authenticated attackers can execute arbitrary operating-system commands as the DIRAC service account, exposing dirac.cfg, database passwords, stored proxies, tokens, and enabling full compromise of the DIRAC deployment.
Affected Products
- DIRAC versions prior to 8.0.79
- DIRAC versions prior to 9.0.22
- DIRAC versions prior to 9.1.10
Discovery Timeline
- 2026-09-15 - CVE-2026-45579 published to NVD
- 2026-09-15 - Last updated in NVD database
Technical Details for CVE-2026-45579
Vulnerability Analysis
The vulnerability originates in DIRAC's Request Management System service layer. The export_getRequestCountersWeb handler accepts a groupingAttribute argument from authenticated clients and forwards it without validation to the database access layer. Inside getRequestCountersWeb, unrecognized attribute names are resolved dynamically against a Request object and passed through a Python evaluation path. An attacker crafts a value containing Python dunder chains, such as walking __class__, __mro__, __subclasses__, and __globals__, to reach os or subprocess primitives. The resulting command runs under the identity of the DIRAC services process, which typically holds broad access to grid credentials and configuration.
Root Cause
The root cause is unsafe evaluation of user-controlled input as Python code [CWE-95]. Instead of restricting groupingAttribute to an allowlist of known columns, the code path resolved arbitrary expressions dynamically, permitting attribute-chain escape from the intended object context to the interpreter's global namespace.
Attack Vector
Exploitation requires network access to the DIRAC service and a valid low-privilege authenticated session. The attacker submits a crafted groupingAttribute value to the getRequestCountersWeb RPC. The scope-changed impact means compromise extends beyond the immediate service to secrets that authenticate DIRAC to databases, storage elements, and proxy delegation infrastructure. See the GitHub Security Advisory GHSA-9jpv-c7p4-997x for the maintainer's technical write-up.
Detection Methods for CVE-2026-45579
Indicators of Compromise
- Unexpected child processes spawned by the DIRAC service account, especially shells (/bin/sh, /bin/bash), python, curl, or wget.
- Access to or exfiltration of dirac.cfg, proxy files under /opt/dirac/, or database credential files by non-administrative sessions.
- RequestManagementSystem service logs containing anomalous groupingAttribute values with characters such as __, ., parentheses, or quotes.
- Truncation, gaps, or tampering in local DIRAC service log files that coincide with RPC activity.
Detection Strategies
- Monitor process lineage on DIRAC hosts to identify service accounts spawning interpreters or shells outside expected job execution paths.
- Deploy runtime rules that flag reads of sensitive DIRAC configuration and credential files by the service process.
- Inspect RPC parameters at the application layer and alert on non-alphanumeric characters in groupingAttribute.
Monitoring Recommendations
- Forward DIRAC service and system audit logs to a centralized SIEM for correlation with process telemetry.
- Track outbound network connections from DIRAC hosts to non-grid destinations, which may indicate reverse shells or exfiltration.
- Baseline typical RequestManagementSystem RPC arguments and alert on statistical outliers.
How to Mitigate CVE-2026-45579
Immediate Actions Required
- Upgrade DIRAC to 8.0.79, 9.0.22, or 9.1.10 depending on the deployed release branch.
- Rotate all secrets accessible to the DIRAC service account, including database passwords, delegated proxies, and API tokens.
- Review authentication logs for unexpected low-privilege sessions and revoke suspicious credentials.
- Audit local log integrity on DIRAC hosts to identify possible tampering.
Patch Information
Maintainers addressed the issue in commits 8ec11072, 99f1af88, and a6f75ce5. Fixed releases are available at v8.0.79, v9.0.22, and v9.1.10.
Workarounds
- Restrict network access to the RequestManagementSystem service to trusted client subnets until patching is complete.
- Reduce the privileges of the DIRAC service account and remove unnecessary filesystem access to configuration and credential stores.
- Where feasible, disable the getRequestCountersWeb endpoint or filter incoming groupingAttribute values through a strict allowlist at a reverse proxy.
# Upgrade DIRAC to a fixed release using pip
pip install --upgrade 'DIRAC==9.1.10'
# Verify installed version
dirac-version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.