CVE-2026-61668: DIRAC Interware RCE Vulnerability

CVE-2026-61668 Overview

CVE-2026-61668 is a certificate validation vulnerability [CWE-295] in DIRAC, a distributed computing framework used by grid computing infrastructures. The flaw resides in WorkloadManagementSystem/Utilities/PilotWrapper.py, where the pilotWrapperScript function uses ssl._create_unverified_context to download the second-stage pilot.tar archive and its reference checksum over unvalidated TLS. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the pilot executable and its checksum. This causes arbitrary code to execute in the pilot context with access to pilot proxy credentials. The issue affects DIRAC versions prior to 8.0.79, 9.0.22, and 9.1.10.

Critical Impact
Attackers with network position can inject arbitrary code into grid pilot jobs and steal pilot proxy credentials, compromising distributed computing workloads.

Affected Products

DIRAC versions prior to 8.0.79 (8.x branch)
DIRAC versions prior to 9.0.22 (9.0.x branch)
DIRAC versions prior to 9.1.10 (9.1.x branch)

Discovery Timeline

2026-09-15 - CVE-2026-61668 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-61668

Vulnerability Analysis

The vulnerability exists in the Python pilot wrapper that grid sites use to bootstrap DIRAC pilot jobs. The pilotWrapperScript function downloads a second-stage archive containing the executable pilot code from a remote server. To handle environments lacking a complete certificate authority bundle, the code explicitly disables TLS certificate verification by calling ssl._create_unverified_context(). The reference checksum used to verify archive integrity is fetched through the same unverified channel, so integrity validation becomes meaningless.

This behavior classifies as improper certificate validation [CWE-295]. Because the download endpoint delivers executable code that runs with the pilot's grid proxy credentials, any tampering with the transport produces immediate code execution. Grid pilot proxies typically carry delegated X.509 credentials tied to a Virtual Organization, so compromise extends to whatever resources the proxy authorizes.

Root Cause

The developers used ssl._create_unverified_context() to avoid TLS handshake failures on grid worker nodes with incomplete trust stores. The fix retains compatibility by loading verification paths from the X509_CERT_DIR environment variable or the standard grid certificate directories (/etc/grid-security/certificates, /cvmfs/grid.cern.ch/etc/grid-security/certificates) rather than skipping validation entirely.

Attack Vector

An attacker who can influence DNS resolution, BGP routing, or the local network path between a grid worker node and the DIRAC pilot download server can present a substituted TLS certificate. The pilot wrapper accepts it without verification, downloads attacker-controlled archive contents plus a matching checksum, and executes the code. Attack complexity is high because it requires an active network position on the grid site's egress path.

python

# Patch: src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py
      # in practice, some prior versions may be composed of recent urllib version containing the param
      if 'context' in url_library_urlopen.__code__.co_varnames:
        import ssl
-        context = ssl._create_unverified_context()
+        context = ssl.create_default_context()
+        check_dirs = [
+          os.environ.get('X509_CERT_DIR', '/etc/grid-security/certificates'),
+          "/cvmfs/grid.cern.ch/etc/grid-security/certificates",
+        ]
+        for cert_dir in check_dirs:
+            if cert_dir and os.path.isdir(cert_dir):
+                context.load_verify_locations(capath=cert_dir)
        remoteFile = url_library_urlopen(os.path.join(loc, fileName),
                                         timeout=10,
                                         context=context)
# Source: https://github.com/DIRACGrid/DIRAC/commit/68029dfb5ddd8b1e4106851f8e37370aa80ac7ae

The patch replaces ssl._create_unverified_context() with ssl.create_default_context() and loads grid certificate authorities from standard trust directories.

Detection Methods for CVE-2026-61668

Indicators of Compromise

Unexpected outbound TLS connections from grid worker nodes to hosts other than the configured DIRAC pilot server.
Pilot log entries showing successful downloads of pilot.tar when the pilot server is unreachable or under maintenance.
Anomalous processes spawned by the pilot wrapper that do not match previous pilot job telemetry.
Use of pilot proxy credentials against grid resources outside the Virtual Organization's normal workload pattern.

Detection Strategies

Inspect DIRAC installations for calls to ssl._create_unverified_context in PilotWrapper.py and confirm the version is at or above the fixed releases.
Baseline outbound network traffic from grid worker nodes and alert on TLS connections that fail certificate pinning against the expected DIRAC pilot server.
Correlate pilot job launch events with process execution logs to identify pilot wrappers executing unexpected binaries or scripts.

Monitoring Recommendations

Enable X.509 audit logging on the DIRAC pilot server and reconcile served archive hashes with those observed on worker nodes.
Monitor DNS query logs from grid sites for resolutions of the pilot server hostname that return unexpected IP addresses.
Track pilot proxy usage in grid accounting records for jobs that touch resources inconsistent with declared workflows.

How to Mitigate CVE-2026-61668

Immediate Actions Required

Upgrade DIRAC to version 8.0.79, 9.0.22, or 9.1.10 depending on the deployed branch.
Ensure grid worker nodes provide a valid certificate directory via X509_CERT_DIR or have /etc/grid-security/certificates populated with IGTF-accredited CAs.
Rotate any pilot proxy credentials that may have been exposed on worker nodes suspected of running unpatched pilot wrappers.

Patch Information

DIRAC published fixes in Release v8.0.79, Release v9.0.22, and Release v9.1.10. The patch commits are 68029df, 92e2e26, and b332c43. Full details are in GitHub Security Advisory GHSA-vg99-gr89-qhw9.

Workarounds

Restrict grid worker egress to only the known DIRAC pilot server IP addresses using firewall rules until patches are applied.
Deploy DNSSEC-validating resolvers on grid sites to reduce the risk of DNS-based redirection attacks against the pilot download path.
Manually enforce out-of-band verification of the pilot.tar archive checksum against a trusted source before permitting pilot execution where feasible.

bash

# Verify installed DIRAC version and confirm the fix is present
python -c "import DIRAC; print(DIRAC.version)"
grep -n "_create_unverified_context" $(python -c "import DIRAC, os; print(os.path.join(os.path.dirname(DIRAC.__file__), 'WorkloadManagementSystem/Utilities/PilotWrapper.py'))")
# Ensure the grid CA directory is populated
ls /etc/grid-security/certificates | head
export X509_CERT_DIR=/etc/grid-security/certificates