CVE-2026-61667: DIRAC Framework SQL Injection Vulnerability

CVE-2026-61667 Overview

CVE-2026-61667 is a SQL injection vulnerability in DIRAC, a software framework for distributed computing. The flaw resides in DataManagementSystem/Service/FileCatalogHandler.py where the checkDataset method forwards an authenticated caller-controlled datasets value into DatasetManager.py__checkDataset. The datasetName parameter is interpolated into an FC_MetaDatasets SQL query without parameterization. Attackers can control the returned MetaQuery value, which is subsequently passed to Python eval, enabling arbitrary command execution as the account running the DIRAC services. The issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Critical Impact
Successful exploitation exposes dirac.cfg, database passwords, stored proxies, and tokens, and allows full compromise of the DIRAC system, including alteration of local log evidence.

Affected Products

DIRAC versions prior to 8.0.79
DIRAC versions prior to 9.0.22
DIRAC versions prior to 9.1.10

Discovery Timeline

2026-09-15 - CVE-2026-61667 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-61667

Vulnerability Analysis

The vulnerability chains two distinct weaknesses into remote code execution. First, the checkDataset handler in FileCatalogHandler.py accepts a caller-supplied datasets value from any authenticated client. That value flows to DatasetManager.__checkDataset, where datasetName is directly interpolated into a raw SQL statement targeting the FC_MetaDatasets table. Because the query is not parameterized, an attacker can craft input that alters query semantics and controls the MetaQuery column returned by the database.

The second stage is more severe. DIRAC then passes the attacker-controlled MetaQuery string to Python's built-in eval function. Any expression the attacker places into that column executes in the context of the DIRAC service account. This turns a SQL injection primitive into full remote code execution without additional exploitation steps.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89], compounded by unsafe use of eval on database-sourced data. The FC_MetaDatasets query builds SQL through string interpolation, and downstream code trusts the returned value as safe Python.

Attack Vector

An authenticated client with the ability to call FileCatalogHandler.checkDataset sends a crafted datasets argument. The injected SQL controls the MetaQuery result, which is then evaluated as Python by the DIRAC service. The attacker gains code execution as the DIRAC service user, allowing theft of dirac.cfg contents, database credentials, stored X.509 proxies, and OAuth tokens.

python

# Security patch: replace unsafe eval with SaferEval
# Source: https://github.com/DIRACGrid/DIRAC/commit/106f6efb40eb7318473fc09fc48083f1f864460a

 from DIRAC import S_OK, S_ERROR, gLogger
 from DIRAC.Core.Utilities.List import stringListToString
+from DIRAC.Core.Utilities.SaferEval import saferEval


 class DatasetManager:

The patch substitutes saferEval for eval in DatasetManager, removing the arbitrary Python execution primitive downstream of the SQL injection.

Detection Methods for CVE-2026-61667

Indicators of Compromise

Unexpected child processes spawned by the DIRAC service user, particularly shell interpreters, Python one-liners, or network utilities.
Anomalous read access to dirac.cfg, proxy stores, or database credential files outside normal service startup.
SQL statements against FC_MetaDatasets containing quote characters, UNION, or comment sequences within the datasetName field.
Modifications or truncation of DIRAC service logs during or immediately after suspicious checkDataset calls.

Detection Strategies

Enable SQL query logging on the File Catalog database and alert on syntactically anomalous queries targeting FC_MetaDatasets.
Instrument the FileCatalogHandler.checkDataset endpoint to log caller identity and full datasets argument content for offline review.
Baseline the DIRAC service account's process tree and alert on deviations such as newly executed binaries or outbound network connections.

Monitoring Recommendations

Forward DIRAC application logs, database audit logs, and host process telemetry to a centralized data lake for correlation.
Monitor authentication events for the File Catalog service to identify low-privilege accounts abusing checkDataset.
Track integrity of credential and configuration files including dirac.cfg, proxy caches, and token stores.

How to Mitigate CVE-2026-61667

Immediate Actions Required

Upgrade DIRAC to version 8.0.79, 9.0.22, or 9.1.10 depending on your deployed branch.
Rotate all secrets accessible to the DIRAC service account, including database passwords, stored proxies, and API tokens.
Review File Catalog and application logs for evidence of prior exploitation, treating log gaps as suspicious.

Patch Information

The fix is available in DIRAC Release v8.0.79, DIRAC Release v9.0.22, and DIRAC Release v9.1.10. Full remediation details are documented in GitHub Security Advisory GHSA-m4m7-4cw8-62j6. The primary code change replaces eval with saferEval in DatasetManager.py, as shown in commit 106f6ef.

Workarounds

Restrict network access to the File Catalog service so that only trusted, vetted clients can reach checkDataset.
Reduce privileges of the DIRAC service account and isolate the database user so that a code-execution outcome yields minimal lateral movement.
If upgrading is not immediately possible, disable or firewall the checkDataset handler until the patched release is deployed.

bash

# Example: pin DIRAC to a patched release via pip
pip install --upgrade "DIRAC==9.1.10"

# Verify installed version
python -c "import DIRAC; print(DIRAC.version)"