CVE-2024-24825: critical vulnerability in DIRACGrid DIRAC
TokenManager not checking permissions on cached tokens in DIRAC
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.1epss 0.5%
DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
DIRACGrid · DIRACRelated CVEs — DIRACGrid DIRAC
In the same product, most dangerous first.
CVE-2026-61667CRITICALDIRAC: RCE in FileCatalog DatasetManager via SQL injection + evalEPSS 1.2%CVE-2026-45579CRITICALDIRAC: RCE in RequestManager due to eval on untrusted inputEPSS 0.9%CVE-2026-61668HIGHDIRAC: Pilot code downloaded over unverified HTTPS connectionEPSS 0.4%CVE-2024-29905HIGHDIRAC: Unauthorized users can read proxy contents during generationEPSS 0.3%