CVE-2026-45579

Unauthenticated code exec via crafted groupingAttribute in DIRAC request counters.

• CVSS 9.9
• 95
• Input Validation and Sanitization
• Remote

DIRAC is an interware, meaning a software framework for distributed computing. Prior to versions 8.0.79, 9.0.22, and 9.1.10, the RequestManagementSystem/Service/ReqManagerHandler.py export_getRequestCountersWeb function passes an authenticated caller-controlled groupingAttribute to RequestManagementSystem/DB/RequestDB.py getRequestCountersWeb. An unrecognized value is resolved against the Request object and evaluated as Python code, allowing a crafted dunder attribute expression to reach operating-system functions and execute commands as the account running the DIRAC services. Successful exploitation can expose dirac.cfg, database passwords, stored proxies, and tokens, fully compromise the DIRAC system, and allow alteration of local log evidence. This issue is fixed in versions 8.0.79, 9.0.22, and 9.1.10.

CVE

CVE-2026-45579

CWE

95

CVSS base score

9.9

Published

2026-09-15

OWASP

A01 Injection

Orthogonal defect classification

Interface

Code defect classification

Incorrect Interface

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Affected component

DIRAC

Fixed by upgrading

Yes

Solution

Upgrade DIRAC to version 8.0.79 or later (or 9.0.22 or later, or 9.1.10 or later).

import re
from RequestManagementSystem.DB import RequestDB

def export_getRequestCountersWeb(groupingAttribute, startDate, endDate):
    """
    Return request counters grouped by the supplied attribute.
    """
    # VULNERABLE: unsanitized groupingAttribute is eval'ed in DB layer
    counters = RequestDB.getRequestCountersWeb(groupingAttribute, startDate, endDate)
    return counters

import re
from RequestManagementSystem.DB import RequestDB

ALLOWED_GROUPS = {"Status", "Owner", "CreationTime"}

def export_getRequestCountersWeb(groupingAttribute, startDate, endDate):
    """
    Return request counters grouped by the supplied attribute.
    """
    # FIX: whitelist allowed grouping attributes before passing to DB
    if groupingAttribute not in ALLOWED_GROUPS:
        raise ValueError(f"Invalid grouping attribute: {groupingAttribute}")
    counters = RequestDB.getRequestCountersWeb(groupingAttribute, startDate, endDate)
    return counters

__VAITP_MODEL_REFUSED__

@misc{vaitp:cve202645579,
  title        = {{Unauthenticated code exec via crafted groupingAttribute in DIRAC request counters.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-45579},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-45579/}}
}