SQL Injection Vulnerability in DIRAC Distributed Computing Software
CVE-2026-61667
9.9CRITICAL
What is CVE-2026-61667?
The DIRAC framework for distributed computing has a vulnerability in its DataManagementSystem, where an unauthenticated user can manipulate query data. An oversight in the code allows dataset values to be interpolated into SQL queries without proper parameterization. This flaw can lead to command execution within the service context, exposing critical configurations, database credentials, and potentially allowing attackers to alter local logs. It is crucial to secure installations by upgrading to the patched versions 8.0.79, 9.0.22, or 9.1.10 to prevent exploitation.
Affected Version(s)
DIRAC >= 6r0, < 8.0.79 < 6r0, 8.0.79
DIRAC >= 9.0.0a1, < 9.0.22 < 9.0.0a1, 9.0.22
DIRAC >= 9.1.0, < 9.1.10 < 9.1.0, 9.1.10