CVE-2026-61667: SQL Injection to RCE in DIRAC FileCatalog DatasetManager

What's the vulnerability?

CVE-2026-61667 is a SQL injection vulnerability (CWE-89) in DIRAC's FileCatalog DatasetManager component. On its own, SQL injection in a metadata catalog service is bad enough, but this flaw can be chained with unsafe use of Python's eval() (CWE-95) to achieve full remote code execution against the DIRAC service process. With a CVSS score of 9.9, this is about as severe as it gets: an unauthenticated or low-privileged attacker able to reach the DatasetManager RPC interface can potentially pivot from a database query to arbitrary code execution on the host.

Affected software

The vulnerability affects the DIRAC package (distributed via pip) across a wide range of releases:

• ≥ 6, < 8.0.79
• ≥ 8.1.0a1, < 9.0.22
• ≥ 9.1.0, < 9.1.10

No patched date has been recorded yet, so organizations running any version in these ranges should treat this as currently unresolved and prioritize compensating controls and detection.

Exploitation status

A public proof-of-concept is available (GHSA-m4m7-4cw8-62j6), meaning working exploit details are already circulating. This is not yet flagged as under active exploitation in the wild (KEV), but PoC-public status historically precedes weaponization by attackers and red teams alike — defenders should not wait for confirmed in-the-wild activity before deploying detection.

How our detection catches it

Our detection logic targets the full exploitation chain rather than a single signature. It looks for:

• Anomalous SQL error signatures returned by the FileCatalog backend, consistent with injection probing or malformed query syntax reaching the database layer
• Injection payload patterns embedded in DatasetManager RPC call parameters, indicative of attempts to manipulate the underlying SQL query construction
• Suspicious process spawning originating from the DIRAC service process itself, which would indicate the eval()-based code execution step succeeded following a successful injection

This layered approach — network/RPC-level payload detection combined with host-level process lineage monitoring — helps catch both the initial injection attempt and confirmed post-exploitation activity. The detection ships with logic for Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), QRadar (AQL), Sumo Logic, Chronicle (YARA-L), and CrowdStrike (CQL), so teams can deploy it across whichever SIEM or EDR stack sits in front of their DIRAC infrastructure.

Get the full detection

For the complete, ready-to-deploy queries across all supported platforms, see the full detection page for CVE-2026-61667.