CVE-2022-51020

5.9Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.9Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: High impact on availability
Weakness: CWE-352

Impact

Remote attackers can shut down Celery workers, resize worker pools, or revoke tasks by tricking an authenticated Flower user into visiting a malicious site.

Root cause

Tornado's xsrf_cookies setting is disabled and OAuth session cookies omit the SameSite attribute, leaving control API endpoints exposed to cross-site request forgery.

Affected systems

Flower before 2.2.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Fix & remediation

Upgrade Flower to version 2.2.0 or newer. If you cannot patch immediately, restrict network access to the Flower web UI so users cannot access it across untrusted browser sessions.

shell

$ pip install --upgrade 'flower>=2.2.0'

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

References

Source: nvd.nist.gov/vuln/detail/CVE-2022-51020