CVE-2026-45579
Received Received - Intake

Command Injection in DIRAC Interware

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-45579
EUVD
EUVD-2026-78894

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
dirac dirac to 8.0.79 (inc)
dirac dirac to 9.0.22 (inc)
dirac dirac to 9.1.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in DIRAC software versions before 8.0.79, 9.0.22, and 9.1.10. It involves the export_getRequestCountersWeb function passing a user-controlled input to getRequestCountersWeb. The input is evaluated as Python code, allowing attackers to execute arbitrary commands on the system running DIRAC services.

Detection Guidance

Detecting this vulnerability requires checking the DIRAC software version and inspecting for suspicious activity in logs or command execution. Verify if your DIRAC version is below 8.0.79, 9.0.22, or 9.1.10. Look for unauthorized command execution attempts or unusual access to dirac.cfg, database passwords, or stored proxies.

Impact Analysis

Exploitation can expose sensitive files like dirac.cfg, database passwords, stored proxies, and tokens. It may fully compromise the DIRAC system and allow attackers to alter local log evidence, leading to potential data breaches or unauthorized system access.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected DIRAC versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Immediately upgrade DIRAC to versions 8.0.79, 9.0.22, or 9.1.10 or later. Review system logs for signs of exploitation, such as unauthorized command execution or access to sensitive files. Restrict access to the DIRAC services account and rotate credentials for dirac.cfg, database passwords, and stored proxies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45579. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart