Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2022-51020Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Medium 5.9

In plain English

A medium-severity cross-site request forgery in flower from mher. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.1%top 96.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

Affected products (as reported)

Vendor	Product	Versions
mher	flower	0 – before 2.2.0

Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

References

GitHub Issue #1217 issue-tracking
Patch Commit patch
Patch Commit patch
Vulnerable code in flower/api/control.py technical-description
https://github.com/mher/flower product
VulnCheck Advisory: Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints third-party-advisory