PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-47161 inducer CVE debrief

CVE-2026-47161 documents a HIGH-severity vulnerability in RELATE, a web-based courseware package. The issue stems from Celery workers configured to accept and deserialize untrusted pickle data, enabling arbitrary command execution by any attacker with access to the message broker. When combined with missing network isolation in the code execution sandbox, an authenticated student can achieve full Remote Code Execution (RCE) on the host system. The vulnerability was addressed in commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb. The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, and high impact to confidentiality, integrity, and availability.

Vendor
inducer
Product
relate
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-01
Advisory published
2026-05-27
Advisory updated
2026-06-01

Who should care

Organizations running RELATE LMS instances, educational institutions using the platform for coursework, security teams managing Celery-based task queues, and administrators responsible for sandboxed code execution environments

Technical summary

The vulnerability exists in RELATE's Celery worker configuration, which uses Python's pickle module for task serialization. Pickle deserialization of untrusted data allows arbitrary code execution during object unpickling. An attacker with message broker access can inject malicious pickle payloads that execute when workers process tasks. The missing network isolation in the sandboxed code execution environment compounds this by allowing authenticated students to reach the broker and escalate to host-level RCE. The fix commit removes pickle acceptance from Celery configuration.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade RELATE to commit d66ba5659b459bf1ba56b7109b5f9ecf197cbefb or later
  • Review Celery worker configuration to ensure pickle serialization is disabled in favor of JSON or msgpack
  • Implement network segmentation to isolate message brokers from untrusted networks
  • Audit code execution sandbox configurations for proper network isolation
  • Monitor for unauthorized access attempts to message broker infrastructure
  • Review application logs for suspicious deserialization activity or unexpected Celery task execution

Evidence notes

The vulnerability description is sourced from the official CVE record published by NVD on 2026-05-27. The fix commit and GitHub Security Advisory are cited as primary references. The weakness is classified as CWE-502 (Deserialization of Untrusted Data). Vendor identification is marked as requiring review due to incomplete product attribution in the source data.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-47161 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-47161

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-47161 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-47161

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.