CVE-2026-47161: RELATE Vulnerable to Remote Code Execution (RCE) via Insecure Celery Pickle Deserialization

Synopsis

An insecure deserialization vulnerability in RELATE LMS allows an authenticated attacker to achieve remote code execution on the host server. The flaw stems from Celery workers accepting and deserializing untrusted pickle data without validation; an attacker who can reach the message broker can send a crafted payload that runs arbitrary commands. The CVSS v4.0 score is 8.7 (High), and no fix version has been published yet. HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Celery message broker over the network to deliver a malicious serialized payload.

• AuthenticationRequired

  Any low-privilege account (such as a student account) is sufficient to initiate the exploit path; no administrative access is needed.

• Victim interactionNot required

  No victim action is required; the attacker submits the payload directly to the broker without social engineering.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, special memory layout, or other unpredictable environmental factors.

Blast Radius

• Reads any data accessible on the host system, including environment variables, credentials, and stored course records.
• Modifies or deletes files and persisted database rows reachable from the compromised worker process.
• Executes arbitrary operating system commands on the host server, enabling installation of backdoors or lateral movement tools.
• Crashes or disrupts the RELATE application and its Celery worker pool, taking the courseware offline for all users.