Find a vulnerability
Search criteria
Related vulnerabilities
GHSA-VG99-GR89-QHW9
Vulnerability from github – Published: 2026-07-13 18:37 – Updated: 2026-07-13 18:37Summary
The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.
Details
The pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python < 2.7.9 behaviour): https://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296
This means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials).
The HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly.
Impact
This would require a man-in-the-middle style attack against a grid site's network (i.e. changing the DNS or routing to redirect the pilot's connection); this is likely to be difficult which probably limits the potential impact.
Patched versions:
https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "DIRAC"
},
"ranges": [
{
"events": [
{
"introduced": "6.20.1"
},
{
"fixed": "8.0.79"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "DIRAC"
},
"ranges": [
{
"events": [
{
"introduced": "8.1.0a1"
},
{
"fixed": "9.0.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "DIRAC"
},
"ranges": [
{
"events": [
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-61668"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-13T18:37:51Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nThe second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers\u0027 SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.\n\n### Details\nThe pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python \u003c 2.7.9 behaviour):\nhttps://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296\n\nThis means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials).\n\nThe HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly.\n\n### Impact\nThis would require a man-in-the-middle style attack against a grid site\u0027s network (i.e. changing the DNS or routing to redirect the pilot\u0027s connection); this is likely to be difficult which probably limits the potential impact.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
"id": "GHSA-vg99-gr89-qhw9",
"modified": "2026-07-13T18:37:51Z",
"published": "2026-07-13T18:37:51Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9"
},
{
"type": "PACKAGE",
"url": "https://github.com/DIRACGrid/DIRAC"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/8.0.79"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/9.0.22"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/9.1.10"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "DIRAC: Pilot code downloaded over unverified HTTPS connection"
}
PYSEC-2026-3464
Vulnerability from pysec - Published: 2026-07-23 11:41 - Updated: 2026-07-23 14:31Summary
The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.
Details
The pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python < 2.7.9 behaviour): https://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296
This means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials).
The HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly.
Impact
This would require a man-in-the-middle style attack against a grid site's network (i.e. changing the DNS or routing to redirect the pilot's connection); this is likely to be difficult which probably limits the potential impact.
Patched versions:
https://pypi.org/project/DIRAC/8.0.79/ https://pypi.org/project/DIRAC/9.0.22/ https://pypi.org/project/DIRAC/9.1.10/
| Name | purl | dirac | pkg:pypi/dirac |
|---|
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "dirac",
"purl": "pkg:pypi/dirac"
},
"ranges": [
{
"events": [
{
"introduced": "6.20.1"
},
{
"fixed": "8.0.79"
},
{
"introduced": "8.1.0a1"
},
{
"fixed": "9.0.22"
},
{
"introduced": "9.1.0"
},
{
"fixed": "9.1.10"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"7.2.0",
"7.2.0a32",
"7.2.0a33",
"7.2.0a34",
"7.2.0a35",
"7.2.0a36",
"7.2.0a38",
"7.2.0a39",
"7.2.1",
"7.2.10",
"7.2.12",
"7.2.13",
"7.2.14",
"7.2.15",
"7.2.16",
"7.2.19",
"7.2.2",
"7.2.20",
"7.2.21",
"7.2.22",
"7.2.23",
"7.2.24",
"7.2.25",
"7.2.26",
"7.2.27",
"7.2.28",
"7.2.3",
"7.2.30",
"7.2.31",
"7.2.32",
"7.2.33",
"7.2.34",
"7.2.35",
"7.2.36",
"7.2.37",
"7.2.38",
"7.2.39",
"7.2.4",
"7.2.40",
"7.2.41",
"7.2.42",
"7.2.43",
"7.2.44",
"7.2.45",
"7.2.46",
"7.2.47",
"7.2.48",
"7.2.49",
"7.2.5",
"7.2.50",
"7.2.51",
"7.2.52",
"7.2.6",
"7.2.7",
"7.2.8",
"7.2.9",
"7.2a29",
"7.3.0a10",
"7.3.0a11",
"7.3.0a13",
"7.3.0a14",
"7.3.0a15",
"7.3.0a16",
"7.3.0a17",
"7.3.0a18",
"7.3.0a19",
"7.3.0a2",
"7.3.0a20",
"7.3.0a21",
"7.3.0a22",
"7.3.0a23",
"7.3.0a24",
"7.3.0a3",
"7.3.0a4",
"7.3.0a5",
"7.3.0a6",
"7.3.0a7",
"7.3.0a8",
"7.3.0a9",
"7.3.1",
"7.3.10",
"7.3.11",
"7.3.12",
"7.3.13",
"7.3.14",
"7.3.15",
"7.3.16",
"7.3.17",
"7.3.18",
"7.3.19",
"7.3.2",
"7.3.20",
"7.3.21",
"7.3.22",
"7.3.23",
"7.3.24",
"7.3.26",
"7.3.27",
"7.3.28",
"7.3.29",
"7.3.3",
"7.3.30",
"7.3.31",
"7.3.32",
"7.3.33",
"7.3.34",
"7.3.35",
"7.3.36",
"7.3.37",
"7.3.38",
"7.3.4",
"7.3.5",
"7.3.6",
"7.3.7",
"7.3.8",
"7.3.9",
"7.4.0a1",
"8.0.0",
"8.0.0a1",
"8.0.0a10",
"8.0.0a11",
"8.0.0a12",
"8.0.0a13",
"8.0.0a14",
"8.0.0a15",
"8.0.0a16",
"8.0.0a17",
"8.0.0a18",
"8.0.0a19",
"8.0.0a20",
"8.0.0a21",
"8.0.0a22",
"8.0.0a23",
"8.0.0a24",
"8.0.0a25",
"8.0.0a26",
"8.0.0a27",
"8.0.0a28",
"8.0.0a29",
"8.0.0a5",
"8.0.0a6",
"8.0.0a7",
"8.0.0a8",
"8.0.0a9",
"8.0.1",
"8.0.10",
"8.0.11",
"8.0.12",
"8.0.13",
"8.0.14",
"8.0.15",
"8.0.16",
"8.0.17",
"8.0.18",
"8.0.19",
"8.0.2",
"8.0.20",
"8.0.21",
"8.0.22",
"8.0.23",
"8.0.24",
"8.0.25",
"8.0.26",
"8.0.27",
"8.0.28",
"8.0.29",
"8.0.3",
"8.0.30",
"8.0.31",
"8.0.32",
"8.0.33",
"8.0.34",
"8.0.35",
"8.0.36",
"8.0.37",
"8.0.38",
"8.0.39",
"8.0.4",
"8.0.40",
"8.0.41",
"8.0.42",
"8.0.43",
"8.0.44",
"8.0.45",
"8.0.46",
"8.0.47",
"8.0.48",
"8.0.49",
"8.0.5",
"8.0.50",
"8.0.51",
"8.0.52",
"8.0.53",
"8.0.54",
"8.0.55",
"8.0.56",
"8.0.58",
"8.0.59",
"8.0.6",
"8.0.60",
"8.0.61",
"8.0.62",
"8.0.63",
"8.0.64",
"8.0.65",
"8.0.66",
"8.0.67",
"8.0.68",
"8.0.69",
"8.0.7",
"8.0.70",
"8.0.71",
"8.0.72",
"8.0.73",
"8.0.74",
"8.0.75",
"8.0.76",
"8.0.77",
"8.0.78",
"8.0.8",
"8.0.9",
"8.1.0a1",
"8.1.0a10",
"8.1.0a11",
"8.1.0a12",
"8.1.0a13",
"8.1.0a14",
"8.1.0a15",
"8.1.0a16",
"8.1.0a17",
"8.1.0a18",
"8.1.0a19",
"8.1.0a2",
"8.1.0a20",
"8.1.0a21",
"8.1.0a22",
"8.1.0a23",
"8.1.0a3",
"8.1.0a4",
"8.1.0a5",
"8.1.0a6",
"8.1.0a7",
"8.1.0a8",
"8.1.0a9",
"9.0.0",
"9.0.0a1",
"9.0.0a10",
"9.0.0a11",
"9.0.0a12",
"9.0.0a13",
"9.0.0a16",
"9.0.0a17",
"9.0.0a18",
"9.0.0a19",
"9.0.0a2",
"9.0.0a20",
"9.0.0a21",
"9.0.0a22",
"9.0.0a23",
"9.0.0a24",
"9.0.0a25",
"9.0.0a26",
"9.0.0a27",
"9.0.0a28",
"9.0.0a29",
"9.0.0a3",
"9.0.0a30",
"9.0.0a31",
"9.0.0a35",
"9.0.0a36",
"9.0.0a37",
"9.0.0a38",
"9.0.0a39",
"9.0.0a4",
"9.0.0a40",
"9.0.0a41",
"9.0.0a42",
"9.0.0a43",
"9.0.0a44",
"9.0.0a45",
"9.0.0a46",
"9.0.0a47",
"9.0.0a48",
"9.0.0a49",
"9.0.0a5",
"9.0.0a50",
"9.0.0a51",
"9.0.0a52",
"9.0.0a53",
"9.0.0a54",
"9.0.0a55",
"9.0.0a56",
"9.0.0a57",
"9.0.0a58",
"9.0.0a59",
"9.0.0a6",
"9.0.0a60",
"9.0.0a61",
"9.0.0a62",
"9.0.0a63",
"9.0.0a64",
"9.0.0a66",
"9.0.0a67",
"9.0.0a68",
"9.0.0a69",
"9.0.0a70",
"9.0.1",
"9.0.10",
"9.0.11",
"9.0.12",
"9.0.13",
"9.0.14",
"9.0.15",
"9.0.16",
"9.0.17",
"9.0.18",
"9.0.19",
"9.0.2",
"9.0.20",
"9.0.21",
"9.0.4",
"9.0.5",
"9.0.6",
"9.0.7",
"9.0.8",
"9.0.9",
"9.1.0",
"9.1.1",
"9.1.2",
"9.1.3",
"9.1.4",
"9.1.5",
"9.1.6",
"9.1.7",
"9.1.8",
"9.1.9"
]
}
],
"aliases": [
"CVE-2026-61668",
"GHSA-vg99-gr89-qhw9"
],
"details": "### Summary\nThe second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers\u0027 SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.\n\n### Details\nThe pilot wrapper downloads and executes the main second stage pilot script, but the SSL validation on this connection is explicitly disabled (to match old python \u003c 2.7.9 behaviour):\nhttps://github.com/DIRACGrid/DIRAC/blob/integration/src/DIRAC/WorkloadManagementSystem/Utilities/PilotWrapper.py#L292-L296\n\nThis means that the second stage pilot code is not verified in any way and could potentially be altered by a man-in-the-middle attack to execute arbitrary code in the pilot context (i.e. with access to the pilot proxy/credentials).\n\nThe HTTPS connection should be validated against both the system certificates and $X509_CERT_DIR and fail if neither validate correctly.\n\n### Impact\nThis would require a man-in-the-middle style attack against a grid site\u0027s network (i.e. changing the DNS or routing to redirect the pilot\u0027s connection); this is likely to be difficult which probably limits the potential impact.\n\n### Patched versions:\nhttps://pypi.org/project/DIRAC/8.0.79/\nhttps://pypi.org/project/DIRAC/9.0.22/\nhttps://pypi.org/project/DIRAC/9.1.10/",
"id": "PYSEC-2026-3464",
"modified": "2026-07-23T14:31:01.458080Z",
"published": "2026-07-23T11:41:45.003752Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9"
},
{
"type": "PACKAGE",
"url": "https://github.com/DIRACGrid/DIRAC"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/8.0.79"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/9.0.22"
},
{
"type": "WEB",
"url": "https://pypi.org/project/DIRAC/9.1.10"
},
{
"type": "PACKAGE",
"url": "https://pypi.org/project/dirac"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-vg99-gr89-qhw9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61668"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "DIRAC: Pilot code downloaded over unverified HTTPS connection"
}