CVE-2011-4356: Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not th...

Security readout for executives and security teams

This is an old Celery local privilege-escalation issue. Some Celery 2.x processes appeared to drop privileges with --uid/--gid, but did not fully drop the real user/group ID. A local user able to run crafted code in the worker process could potentially regain higher privileges. Exposure is most likely on legacy systems running affected Celery 2.x versions, especially where Celery processes are launched with elevated privileges and rely on --uid/--gid for privilege dropping. Modern deployments are unlikely to be affected unless old packages remain in use. Treat as a targeted legacy-risk item. It deserves prompt remediation where affected Celery 2.x runs on shared or sensitive hosts, but the provided evidence does not support emergency internet-wide response. Mitigation focus: Upgrade affected Celery 2.x deployments to fixed versions or later supported releases.; Check current Celery project or vendor guidance for maintained remediation advice.; Avoid launching Celery processes as root when possible..

Prepared

Jun 27, 2026, 17:48 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.