Vulnerability · Published Sep 25, 2026 · Assigned by VulnCheck

CVE-2026-100418Flame through 2.4.0 Information Exposure via GET /api/config

Medium 5.3

In plain English

A medium-severity information exposure in flame from pawelmalak. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 63.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

Affected products (as reported)

Vendor	Product	Versions
pawelmalak	flame	0 – through 2.4.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

GitHub Issue #494 (finding 4) issue-tracking
getConfig.js returns full config without redaction technical-description
GET /api/config registered without auth middleware technical-description
WEATHER_API_KEY is part of the config object technical-description
https://github.com/pawelmalak/flame product
VulnCheck Advisory: Flame through 2.4.0 Information Exposure via GET /api/config third-party-advisory