Unverified TLS Context in DIRAC Affects Distributed Computing Security
CVE-2026-61668
8.1HIGH
What is CVE-2026-61668?
The vulnerability in DIRAC relates to the absence of TLS certificate verification in the PilotWrapperScript component, enabling potential attackers to manipulate network traffic. By exploiting this oversight, adversaries can replace both the pilot code and its checksum, leading to the execution of arbitrary code with access to sensitive pilot proxy credentials. The issue has been addressed in newer versions, where the system now validates server certificates properly through a trusted certificate directory.
Affected Version(s)
DIRAC >= 6.20.1, < 8.0.79 < 6.20.1, 8.0.79
DIRAC >= 9.0.0a1, < 9.0.22 < 9.0.0a1, 9.0.22
DIRAC >= 9.1.0, < 9.1.10 < 9.1.0, 9.1.10