AIKIDO-2025-10881
celery is vulnerable to Insertion of Sensitive Information into Log File
25
Low Risk
This Affects:
celeryTL;DR
Affected versions of this package may expose sensitive information in log files. When setting up delayed delivery, Celery logs the full broker URL —including the embedded username and password— directly to the DelayedDelivery consumer output. This results in credential leakage and violates standard security practices that prohibit storing secrets in logs.
Who does this affect?
You are affected if you are using a vulnerable version of the package.
Background info
celery is vulnerable to Insertion of Sensitive Information into Log File in versions 5.5.0 - 5.5.3.
How to fix this
Upgrade celery to a patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant