PatchSiren cyber security CVE debrief
CVE-2026-47161 inducer CVE debrief
CVE-2026-47161 documents a HIGH-severity vulnerability in RELATE, a web-based courseware package. The issue stems from Celery workers configured to accept and deserialize untrusted pickle data, enabling arbitrary command execution by any attacker with access to the message broker. When combined with missing network isolation in the code execution sandbox, an authenticated student can achieve full Remote Code Execution (RCE) on the host system. The vulnerability was addressed in commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and high impact to confidentiality, integrity, and availability.
- Vendor
- inducer
- Product
- relate
- CVSS
- HIGH 8.7
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-27
- Original CVE updated
- 2026-05-28
- Advisory published
- 2026-05-27
- Advisory updated
- 2026-05-28
Who should care
Organizations running RELATE LMS instances, educational institutions using the platform for coursework, security teams managing Celery-based task queues, and administrators responsible for sandboxed code execution environments
Technical summary
The vulnerability exists in RELATE's Celery worker configuration, which uses Python's pickle module for task serialization. Pickle deserialization of untrusted data allows arbitrary code execution during object unpickling. An attacker with message broker access can inject malicious pickle payloads that execute when workers process tasks. The missing network isolation in the sandboxed code execution environment compounds this by allowing authenticated students to reach the broker and escalate to host-level RCE. The fix commit removes pickle acceptance from Celery configuration.
Defensive priority
HIGH
Recommended defensive actions
- Upgrade RELATE to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb or later
- Review Celery worker configuration to ensure pickle serialization is disabled in favor of JSON or msgpack
- Implement network segmentation to isolate message brokers from untrusted networks
- Audit code execution sandbox configurations for proper network isolation
- Monitor for unauthorized access attempts to message broker infrastructure
- Review application logs for suspicious deserialization activity or unexpected Celery task execution
Evidence notes
The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix commit and GitHub Security Advisory are cited as primary references. The weakness is classified as CWE-502 (Deserialization of Untrusted Data). Vendor identification is marked as requiring review due to incomplete product attribution in the source data.
Official resources
2026-05-27