CVE-2026-61668: DIRAC: Pilot code downloaded over unverified HTTPS connection

July 13, 2026

The second stage pilot (pilot.tar) is downloaded by the initial wrapper script without any verification of the webservers’ SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel.

References

github.com/DIRACGrid/DIRAC/security/advisories/GHSA-vg99-gr89-qhw9
github.com/advisories/GHSA-vg99-gr89-qhw9
nvd.nist.gov/vuln/detail/CVE-2026-61668
pypi.org/project/DIRAC/8.0.79
pypi.org/project/DIRAC/9.0.22
pypi.org/project/DIRAC/9.1.10

Code Behaviors & Features

Detect and mitigate CVE-2026-61668 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →