ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2026-45579

niche

Authenticated Python Code Execution (RCE) in DIRAC Request Management Service

CVSS 3.1
9.9 critical
EPSS
—
Published
()
Modified
AI analysis

DIRAC, a software framework for distributed computing in scientific communities, contains an eval-injection flaw (CWE-95) in the RequestManagementSystem: the export_getRequestCountersWeb handler in ReqManagerHandler.py passes an authenticated caller-controlled groupingAttribute parameter to RequestDB.getRequestCountersWeb, where an unrecognized value is resolved against the Request object and evaluated as Python code. An attacker with valid DIRAC credentials can supply a crafted dunder-attribute expression to reach operating-system functions and execute arbitrary commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow tampering with local log evidence. The issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10; no public PoC exists and no exploitation has been observed.

What to do: Upgrade immediately to DIRAC 8.0.79, 9.0.22, or 9.1.10 depending on your release track. Restrict access to the Request Management service to trusted users only, and audit authentication logs for unusual calls to getRequestCounters with unexpected groupingAttribute values. Rotate database passwords, stored proxies, and tokens in dirac.cfg, and verify the integrity of local service logs for signs of tampering.

Affected
DIRAC Project DIRAC (distributed computing framework)All versions prior to 8.0.79
DIRAC Project DIRAC (distributed computing framework)9.0.x prior to 9.0.22
DIRAC Project DIRAC (distributed computing framework)9.1.x prior to 9.1.10
Estimated exposure
nichetens of DIRAC service deployments worldwide, low thousands of authenticated users — DIRAC is specialized grid middleware deployed by a limited number of scientific computing communities and research infrastructures rather than the general public, so only a small number of server installations expose the affected service,…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

Weakness
CWE-95
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (—)

In the news

No ingested article mentions this CVE yet.