CVE-2022-51020

MEDIUM 5.9

Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

CVSS Score

5.9

EPSS Score

0.0%

EPSS Percentile

0th

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

CWE	CWE-352
Vendor	mher
Product	flower
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for mher flower

Be the first to know when new medium vulnerabilities affecting mher flower are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Affected Versions

mher / flower

0 < 2.2.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/mher/flower/issues/1217 github.com: https://github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629 github.com: https://github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51 github.com: https://github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27 github.com: https://github.com/mher/flower vulncheck.com: https://www.vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-task-control-api-endpoints

Credits

Fawwaz Musaffa tprynn