{"id":"CVE-2026-61667","summary":"DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval","details":"DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, DataManagementSystem/Service/FileCatalogHandler.py checkDataset forwards an authenticated caller-controlled datasets value to DatasetManager.py __checkDataset, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.","aliases":["GHSA-m4m7-4cw8-62j6","PYSEC-2026-3463"],"modified":"2026-09-17T03:47:02.145282070Z","published":"2026-09-15T17:26:16.456Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61667.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-89","CWE-95"]},"references":[{"type":"WEB","url":"https://github.com/DIRACGrid/DIRAC/releases/tag/v8.0.79"},{"type":"WEB","url":"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.0.22"},{"type":"WEB","url":"https://github.com/DIRACGrid/DIRAC/releases/tag/v9.1.10"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61667.json"},{"type":"ADVISORY","url":"https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-m4m7-4cw8-62j6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61667"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/106f6efb40eb7318473fc09fc48083f1f864460a"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/55ecbd729242ddbe06251b57895873cc468f5a1a"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/5a5def88d65a18c77af9f2900ffb5866d6489d62"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/66cfc8bf1dc13a6d38bf0c5654d5b551d76dce9b"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/6f6fe65f27b6913916ef77a77a09918b94029c0a"},{"type":"FIX","url":"https://github.com/DIRACGrid/DIRAC/commit/fabf08a4a403fdd92d3445771528fa54b3ee902f"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/diracgrid/dirac","events":[{"introduced":"886bbd4fca58c12ed60a4a9d86559bea3c2713d9"},{"introduced":"59eaef990aaaa88e28110ad73188c7c60f64496f"},{"introduced":"dcde834932ee4c746b93872620ce47d4eb0ba316"},{"fixed":"a05a64be9fbf6119080b735ae0a4b2d13cf67a48"},{"fixed":"8f2dcddb4310790da01299da9cad895423b91669"},{"fixed":"2f5c5f3b74ab65b3b7d5687d561bc8deee1e4859"},{"fixed":"106f6efb40eb7318473fc09fc48083f1f864460a"},{"fixed":"55ecbd729242ddbe06251b57895873cc468f5a1a"},{"fixed":"5a5def88d65a18c77af9f2900ffb5866d6489d62"},{"fixed":"66cfc8bf1dc13a6d38bf0c5654d5b551d76dce9b"},{"fixed":"6f6fe65f27b6913916ef77a77a09918b94029c0a"},{"fixed":"fabf08a4a403fdd92d3445771528fa54b3ee902f"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"6r0"},{"fixed":"8.0.79"},{"introduced":"9.0.0a1"},{"fixed":"9.0.22"},{"introduced":"9.1.0"},{"fixed":"9.1.10"}]}}],"versions":["v9.0.21","v9.0.20","v9.1.9","v9.1.8","v9.1.7","v9.1.6","v9.1.5","v9.1.4","v9.1.3","v9.1.2","v9.1.1","v9.1.0","v8.0.78","v9.0.19","v9.0.18","v9.0.17","v8.0.77","v9.0.16","v9.0.15","v9.0.14","v9.0.0a70","v9.0.13","v9.0.12","v9.0.11","v9.0.10","v9.0.9","v9.0.8","v9.0.7","v9.0.6","v9.0.5","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0","v9.0.0a67","v9.0.0a69","v9.0.0a68","v9.0.0a66","v9.0.0a65","v8.0.76","v9.0.0a64","v9.0.0a63","v9.0.0a62","v9.0.0a61","v9.0.0a60","v9.0.0a59","v8.0.75","v9.0.0a58","v9.0.0a57","v8.0.74","v9.0.0a56","v9.0.0a55","v9.0.0a54","v8.0.73","v9.0.0a53","v8.0.72","v9.0.0a52","v9.0.0a50","v9.0.0a48","v9.0.0a51","v9.0.0a49","v9.0.0a47","v9.0.0a46","v9.0.0a45","v8.0.71","v9.0.0a44","v8.0.70","v9.0.0a43","v8.0.69","v8.0.63","v9.0.0a42","v8.0.68","v8.0.67","v9.0.0a41","v8.0.66","v8.0.65","v8.0.64","v8.0.62","v9.0.0a40","v8.0.61","v9.0.0a39","v9.0.0a38","v8.0.60","v9.0.0a37","v9.0.0a36","v8.0.59","v8.0.55","v9.0.0a35","v9.0.0a34","v9.0.0a33","v8.0.58","v8.0.57","v9.0.0a32","v8.0.56","v8.0.54","v9.0.0a31","v9.0.0a30","v8.0.53","v8.0.52","v8.0.51","v8.0.50","v8.0.49","v8.0.48","v9.0.0a29","v8.0.47","v8.0.46","v8.0.45","v8.0.44","v8.0.43","v9.0.0a28","v8.0.42","v8.0.41","v8.0.36","v8.0.40","v9.0.0a27","v8.0.39","v9.0.0a26","v9.0.0a25","v9.0.0a24","v9.0.0a23","v8.0.38","v8.0.37","v9.0.0a22","v9.0.0a21","v9.0.0a20","v8.0.35","v8.0.34","v8.0.33","v9.0.0a4","v9.0.0a3","v8.0.32","v9.0.0a2","v9.0.0a1","v8.0.31","v8.0.30","v8.0.29","v8.0.28","v8.0.27","v8.0.26","v8.0.25","v8.0.24","v8.0.23","v8.0.22","v8.0.21","v8.0.20","v8.0.19","v8.0.18","v8.0.17","v8.0.16","v8.0.15","v8.0.14","v8.0.13","v8.0.12","v8.0.11","v8.0.10","v8.0.9","v8.0.8","v8.0.7","v8.0.6","v8.0.5","v8.0.4","v8.0.3","v8.0.2","v8.0.1","v8r0","v8.0.0a29","v8.0.0a28","v8.0.0a27","v8.0.0a26","v8.0.0a25","v8.0.0a24","v8.0.0a23","v8.0.0a22","v8.0.0a21","v8.0.0a20","v8.0.0a19","v8.0.0.a18","v8.0.0a17","v8.0.0a16","v8.0.0a15","v8.0.0a14","v8.0.0a13","v8.0.0a12","v8.0.0a11","v8.0.0a10","v8.0.0a8","v8.0.0a7","v8r0-pre4","v8r0-pre3","v8r0-pre2","v8r0-pre1","v7r3p1","v7.3.1","v7r4-pre1","v7.4.0a1","v7r3","v7.3.0","v7r3-pre24","v7.3.0a24","v7r3-pre23","v7.3.0a23","v7r3-pre22","v7.3.0a22","v7r3-pre21","v7.3.0a21","v7r3-pre18","v7.3.0a18","v7r3-pre20","v7.3.0a20","v7r3-pre19","v7.3.0a19","v7r3-pre17","v7.3.0a17","v7r3-pre16","v7.3.0a16","v7r3-pre15","v7.3.0a15","v7r3-pre14","v7.3.0a14","v7r3-pre13","v7.3.0a13","v7r3-pre12","v7r3-pre11","v7.3.0a11","v7r3-pre10","v7.3.0a10","v7r3-pre9","v7.3.0a9","v7r3-pre8","v7.3.0a8","v7r3-pre7","v7.3.0a7","v7r3-pre6","v7.3.0a6","v7r3-pre5","v7.3.0a5","v7r3-pre4","v7.3.0a4","v7r3-pre3","v7.3.0a3","v7r3-pre2","v7.3.0a2","v7r3-pre1","v7r2","v7.2.0","v7r2-pre39","v7.2.0a39","v7r2-pre38","v7.2.0a38","v7r2-pre37","v7r2-pre36","v7.2.0a37","v7.2.0a36","v7r2-pre35","v7.2.0a35","v7r2-pre34","v7.2.0a34","v7r2-pre33","v7.2.0a33","v7r2-pre32","v7.2.0a32","v7r2-pre31","v7.2a31","v7r2-pre30","v7r2-pre29","7.2a29","v7r2-pre28","7.2a28","v7r2-pre27","v7r2-pre26","v7r2-pre25","v7r2-pre24","v7r2-pre23","v7r2-pre22","v7r2-pre21","v7r2-pre20","v7r2-pre18","v7r2-pre19","v7r2-pre17","v7r2-pre16","v7r2-pre15","v7r2-pre14","v7r2-pre13","v7r2-pre12","v7r2-pre11","v7r2-pre10","v7r2-pre9","v7r2-pre8","v6r20","v6r19","v6r18p1","v6r18","v6r10p7","v6r10p11","v6r10p10","v6r10p9","v6r10p8","v6r10p6","v6r10p4","v6r10p3","v6r10p2","v6r10p1","v6r10","v6r9p14","v6r9p13","v6r9p12","v6r9p11","v6r9p10","v6r9p9","v6r9p8","v6r9p7","v6r9p6","v6r9p5","v6r9p2","v6r9p1","v6r9","v6r8p14","v6r8p13","v6r8p11","v6r8p10","v6r8p9","v6r8p8","v6r8p7","v6r8p6","v6r8p5","v6r8","v6r8p3","v6r8p2","v6r8p1","v6r7p20","v6r7p19","v6r7p17","v6r7p15","v6r7p18","v6r7p16","v6r7p14","v6r7p13","v6r7p12","v6r7p11","v6r7p10","v6r7p9","v6r7p8","v6r7p7","v6r7p6","v6r7p5","v6r7p4","v6r7p3","v6r7p2","v6r7p1","v6r7","v6r7-pre1","v6r7-pre12","v6r7-pre11","v6r7-pre10","v6r7-pre9","v6r7-pre8","v6r7-pre7","v6r6","v6r7-pre6","v6r7-pre4","v6r7-pre5","v6r7-pre3","v6r7-pre2","v6r6p2","v6r6p1","v6r6-pre14","v6r6-pre13","v6r6-pre12","v6r6-pre11","v6r6-pre10","v6r6-pre7","v6r6-pre9","v6r6-pre8","v6r6-pre6","v6r6-pre3","v6r5p1","v6r6-pre1","v6r6-pre2","v6r5","v6r5-pre15","v6r5-pre12","v6r5-pre14","v6r5-pre13","v6r5-pre9","v6r5-pre11","v6r5-pre10","v6r5-pre8","v6r5-pre7","v6r5-pre6","v6r5-pre4","v6r5-pre5","v6r5-pre3","v6r5-pre2","v6r4p2","v6r5-pre1","v6r3p8","v6r3p7","v6r4p1","v6r4","v6r4-pre4","v6r4-pre3","v6r4-pre2","v6r4-pre1","v6r3p5","v6r3p6","v6r3p4","v6r3p1","v6r3p3","v6r3p2","v6r3","v6r2p9","v6r2p8","v6r2p7","v6r2p6","v6r1p2","v6r1p1","v6r1","v6r0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61667.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}