CVE-2026-61668

DIRAC, a distributed computing framework used by scientific grid collaborations, ships a flaw (CWE-295) in WorkloadManagementSystem/Utilities/PilotWrapper.py where pilotWrapperScript uses ssl._create_unverified_context, downloading the second-stage pilot.tar archive and its reference checksum over TLS without validating the server certificate. An attacker positioned to redirect or intercept a grid site's network traffic — for example via DNS poisoning or routing manipulation — can replace both the executable pilot payload and its checksum, defeating integrity checks entirely. Successful exploitation results in arbitrary code execution in the pilot context, where the code has access to pilot proxy credentials that could be stolen and reused against grid resources. All deployments running versions prior to 8.0.79, 9.0.22, or 9.1.10 are affected; exploitation is plausible only where an attacker can manipulate the network path, reflected in the high-access-complexity CVSS 3.1 score of 8.1. No public proof of concept is known and the issue is not listed in CISA's KEV catalog.

What to do: Upgrade to DIRAC 8.0.79, 9.0.22, or 9.1.10, where the pilot download validates the server certificate against system trust and X509_CERT_DIR (grid certificate directory). Until patched, verify that X509_CERT_DIR and system CA stores are correctly populated, restrict outbound network paths from worker nodes to known pilot-download endpoints, and monitor site DNS/routing for tampering. Review pilot-proxy credential usage logs for anomalies that would indicate a substituted pilot payload.