Answer in brief
CVE-2026-61668 records a High severity secret exfiltration vulnerability in DIRAC: Pilot code downloaded over unverified HTTPS connection. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Answer in brief
CVE-2026-61668 records a High severity secret exfiltration vulnerability in DIRAC: Pilot code downloaded over unverified HTTPS connection. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
Update DIRAC to 8.0.79; DIRAC to 9.0.22; DIRAC to 9.1.10 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSecret Exfiltration describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-61668 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| DIRACpip | >=6.20.1,<8.0.79 | 8.0.79 |
| DIRACpip | >=8.1.0a1,<9.0.22 | 9.0.22 |
| DIRACpip | >=9.1.0,<9.1.10 | 9.1.10 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-61668 records a High severity secret exfiltration vulnerability in DIRAC: Pilot code downloaded over unverified HTTPS connection. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for DIRAC, DIRAC, DIRAC.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate DIRAC to 8.0.79; DIRAC to 9.0.22; DIRAC to 9.1.10 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanSecret Exfiltration describes the vulnerability class recorded for this advisory. The current record does not mark CVE-2026-61668 as known exploited; continue to monitor the source for status changes. The feed includes package mappings that can be checked against lockfiles and deployed manifests.
| Package | Affected range | Fixed version |
|---|---|---|
| DIRACpip | >=6.20.1,<8.0.79 | 8.0.79 |
| DIRACpip | >=8.1.0a1,<9.0.22 | 9.0.22 |
| DIRACpip | >=9.1.0,<9.1.10 | 9.1.10 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
CVE-2026-61668 records a High severity secret exfiltration vulnerability in DIRAC: Pilot code downloaded over unverified HTTPS connection. The source record does not mark it as known exploited. 3 affected packages are mapped in the feed.
The source record does not mark it as known exploited.
Check lockfiles and deployed manifests for DIRAC, DIRAC, DIRAC.
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard### Summary The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel. ### Details The pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python < 2.7.9 behaviour): https://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296 This means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials). The HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly. ### Impact This would require a man-in-the-middle style attack against a grid site's network (i.e. changing the DNS or routing to redirect the pilot's connection); this is likely to be difficult which probably limits the potential impact. ### Patched versions: https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/
### Summary The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel. ### Details The pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python < 2.7.9 behaviour): https://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296 This means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials). The HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly. ### Impact This would require a man-in-the-middle style attack against a grid site's network (i.e. changing the DNS or routing to redirect the pilot's connection); this is likely to be difficult which probably limits the potential impact. ### Patched versions: https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/