Attack Chain

1. An authenticated attacker initiates a request to the DIRAC system, targeting the FileCatalog.checkDataset function.
2. The attacker crafts a malicious datasets argument containing an SQL injection payload and sends it to the backend database handler.
3. The __checkDataset function in DatasetManager.py constructs an SQL query using an f-string with the unescaped, user-controlled datasets argument, creating an SQL injection vulnerability.
4. The injected SQL payload is designed to manipulate the query's result set, inserting arbitrary Python code that the attacker wishes to execute.
5. The database executes the modified query and returns the manipulated result, which now contains the attacker's arbitrary Python code.
6. The DatasetManager.py module immediately passes this returned, attacker-controlled result to Python's eval function.
7. The eval function executes the attacker's arbitrary Python code with the privileges of the DIRAC application.
8. Remote code execution is achieved, allowing the attacker to perform actions such as reading dirac.cfg, exfiltrating database credentials, and deleting log evidence.

Impact

Successful exploitation of CVE-2026-61667 grants any authenticated user the ability to execute arbitrary commands on the DIRAC server, leading to a complete compromise of the system. Attackers can read sensitive configuration files like dirac.cfg, extract database passwords, and exfiltrate all stored proxies and tokens, thereby gaining extensive access to the environment. Furthermore, if local logging is employed, the attacker can leverage this RCE to remove evidence of their activities, hindering incident response and forensic investigations. The vulnerability affects multiple versions of DIRAC, specifically versions from 6 up to 8.0.79, 8.1.0a1 up to 9.0.22, and 9.1.0 up to 9.1.10.

Recommendation

• Immediately update all affected DIRAC installations to a patched version (8.0.79, 9.0.22, or 9.1.10) as listed in the advisory to remediate CVE-2026-61667.
• Ensure proper input validation and parameterized queries are implemented for all database interactions within applications to prevent similar SQL injection vulnerabilities.
• Implement robust logging and monitoring for critical application functions and ensure logs are forwarded to a secure, immutable log management system to prevent tampering, as attackers can remove evidence if local logging is used.