CVE-2026-61667

DIRAC, a software framework for distributed scientific computing, contains a critical flaw in DataManagementSystem/Service/FileCatalogHandler.py where the checkDataset method forwards an authenticated caller-controlled datasets value to DatasetManager.__checkDataset, which interpolates datasetName directly into an FC_MetaDatasets SQL query without parameterization. An attacker can exploit this SQL injection to control the MetaQuery value returned from the database, which is then passed to Python eval, resulting in remote command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow tampering with local log evidence. Any organization running an affected DIRAC version (prior to 8.0.79, 9.0.22, or 9.1.10) with an exposed FileCatalog service is impacted, though exploitation requires an authenticated account. No public proof of concept is known and the flaw is not listed in CISA's KEV, so exploitation in the wild is not currently evidenced.

What to do: Upgrade immediately to DIRAC 8.0.79, 9.0.22, or 9.1.10 depending on your release line. Restrict access to the FileCatalogHandler/checkDataset service to trusted, authenticated users until patched, and audit service logs for anomalous dataset names containing SQL fragments passed to checkDataset. If compromise is suspected, rotate all secrets in dirac.cfg (database passwords, stored proxies, and tokens) and preserve logs, since attackers can alter local log evidence.