CVE-2011-4356

CVE-2011-4356 describes a local privilege escalation vulnerability affecting Celery versions 2.1, 2.2, 2.3, and 2.4. The flaw arises because Celery processes (celerybeat, celeryd_detach, celeryd-multi, celeryev) change the effective user ID but not the real user ID when handling --uid and --gid arguments. This allows a local attacker to execute crafted code with elevated privileges through the worker process. With a CVSS score of 6.9, this vulnerability has high impact on confidentiality, integrity, and availability, but requires medium attack complexity and local access. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.