CVE-2022-51020
Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints
mher flower
CVSS
6.0MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.2.0flowerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
Text from CVE List
Affected versions 2
- floweraffected: all versions before 2.2.0CVE List
- flowerunaffected: 2.2.0CVE List
References 6
- github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629Fixvia CVE List
- github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51Fixvia CVE List
- vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-task-control-api-endpointsAdvisoryvia CVE List
- github.com/mher/flower/issues/1217Referencevia CVE List
- github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27Referencevia CVE List
- github.com/mher/flowerReferencevia CVE List