Answer in brief
CVE-2026-61668 records a High severity (CVSS 8.1) vulnerability in DIRAC: Pilot code downloaded over unverified HTTPS connection. The current sources do not mark it as known exploited. The current feed maps DIRACGrid/DIRAC (generic), DIRAC (pip), DIRAC (pip), DIRAC (pip) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps DIRACGrid/DIRAC (generic), DIRAC (pip), DIRAC (pip), DIRAC (pip) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| DIRACGrid/DIRACgeneric | >= 6.20.1, < 8.0.79 || >= 9.0.0a1, < 9.0.22 || >= 9.1.0, < 9.1.10 | Not reported |
| DIRACpip | >=6.20.1,<8.0.79 | 8.0.79 |
| DIRACpip | >=8.1.0a1,<9.0.22 | 9.0.22 |
| DIRACpip | >=9.1.0,<9.1.10 | 9.1.10 |
| diracpypi | >=6.20.1 <8.0.79 >=8.1.0a1 <9.0.22 >=9.1.0 <9.1.10 | 8.0.79, 9.0.22, 9.1.10 |
Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 13, 2026
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, WorkloadManagementSystem/Utilities/PilotWrapper.py pilotWrapperScript uses ssl._create_unverified_context to download the second-stage pilot.tar archive without TLS certificate verification and downloads the reference checksum through the same unvalidated channel. An attacker able to redirect or intercept a grid site's network traffic through DNS or routing manipulation can substitute both the executable pilot code and its checksum, causing arbitrary code to run in the pilot context with access to pilot proxy credentials. The fixed implementation validates the server certificate through system trust and X509_CERT_DIR or the grid certificate directory. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.
Quoted source text, attributed separately from HOL analysis.