CVE-2022-51020 Details
Description
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.
A cross-site request forgery (CSRF) vulnerability has been identified in Flower versions prior to 2.2.0. This issue arises because Tornado's CSRF protection is disabled, and the OAuth session cookie does not have the SameSite attribute. As a result, attackers can trick authenticated users into visiting malicious pages that send POST requests to specific API endpoints. These requests can shut down Celery workers, restart worker pools, or revoke tasks, thereby disrupting task management and execution.
Users can update to Flower version 2.2.0 or later, where this vulnerability has been fixed. Instructions for updating can be found in the Flower GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 12, 2026CISA-ADP
Assessed Oct 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mher/flower | [email protected] | ProductVendor |
| https://github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27 | [email protected] | Source CodeVendor |
| https://github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51 | [email protected] | Source CodeVendor |
| https://github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629 | [email protected] | Source CodeVendor |
| https://github.com/mher/flower/issues/1217 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-task-control-api-endpoints | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Flower | >= 0, < 2.2.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 12, 2026 | New CVE Received | [email protected] |