CVE-2011-4356
Celery local privilege escalation vulnerability
CVE-2011-4356 is a medium vulnerability (CVSS 6.9) in Celeryproject Celery, published December 5, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in celery 2.2.8.
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
Exploit likelihood
What each source reports
NVD Score used
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
CVE-2011-4356- CVSS 2.0
- 6.9 Medium
AV:L/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
CVE-2011-4356- Updated
- 2026-11-02
EUVDEUVD-2011-0002 No score
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
EUVD-2011-0002- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rpc6-h455-3rx5 No score
Celery local privilege escalation vulnerability
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
GHSA-rpc6-h455-3rx5- Weakness
- CWE-269
- Updated
- 2026-11-02
OSV No score
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
CVE-2011-4356- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-4356 No score
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
DEBIAN-CVE-2011-4356- Updated
- 2026-11-02
OSVGHSA-rpc6-h455-3rx5 No score
Celery local privilege escalation vulnerability
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
GHSA-rpc6-h455-3rx5- Weakness
- CWE-269
- Updated
- 2026-11-02
OSVPYSEC-2011-17 No score
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
- Record
PYSEC-2011-17- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
celeryPyPI |
2.1.0 up to 2.2.8 | 2.2.8 |
celeryPyPI |
2.3.0 up to 2.3.4 | 2.3.4 |
celeryPyPI |
2.4.0 up to 2.4.4 | 2.4.4 |
celeryDebian:12 |
before 2.4.6-1 | 2.4.6-1 |
celeryDebian:13 |
before 2.4.6-1 | 2.4.6-1 |
celeryDebian:14 |
before 2.4.6-1 | 2.4.6-1 |
celeryPyPI |
2.1.0 up to 2.2.8, plus listed versions 2.1.12.1.22.1.32.1.42.2.0 Show 7 moreShow less2.2.12.2.22.2.32.2.42.2.52.2.62.2.7 |
2.2.8 |
celeryPyPI |
2.3.0 up to 2.3.4, plus listed versions 2.3.12.3.22.3.3 |
2.3.4 |
celeryPyPI |
2.4.0 up to 2.4.4, plus listed versions 2.4.12.4.22.4.3 |
2.4.4 |
celeryPyPI |
2.1 up to 2.2.8, 2.3 up to 2.3.4, 2.4 up to 2.4.4, plus listed versions 2.1.02.1.12.1.22.1.32.1.4 Show 16 moreShow less2.2.02.2.12.2.22.2.32.2.42.2.52.2.62.2.72.3.02.3.12.3.22.3.32.4.02.4.12.4.22.4.3 |
2.2.82.3.42.4.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/46973
securityfocus.com/bid/50825
github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt
nvd.nist.gov/vuln/detail/CVE-2011-4356
Show 10 moreShow less
web.archive.org/web/20140722114447/http://secunia.com/advisories/46973
security-tracker.debian.org/tracker/CVE-2011-4356