{"id":"CVE-2022-51020","summary":"Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints","details":"Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.","modified":"2026-10-14T02:45:24.988799812Z","published":"2026-10-12T20:55:06.611Z","database_specific":{"cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51020.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/51xxx/CVE-2022-51020.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-51020"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/flower-before-2.2.0-csrf-via-worker-and-task-control-api-endpoints"},{"type":"REPORT","url":"https://github.com/mher/flower/issues/1217"},{"type":"FIX","url":"https://github.com/mher/flower/commit/3b2115af7f9c42bd2da2fbcbd919f77013e9ec51"},{"type":"FIX","url":"https://github.com/mher/flower/commit/a14408b16cc3d2877d36659005ce0d72b6162629"},{"type":"PACKAGE","url":"https://github.com/mher/flower"},{"type":"ARTICLE","url":"https://github.com/mher/flower/blob/v2.1.0/flower/api/control.py#L25-L27"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/mher/flower","events":[{"introduced":"0"},{"fixed":"4d4a9ac7b1b2f406610669a1b770ec8d15f7b776"},{"fixed":"3b2115af7f9c42bd2da2fbcbd919f77013e9ec51"},{"fixed":"a14408b16cc3d2877d36659005ce0d72b6162629"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.2.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.1.0","v2.0.1","v2.0.0","v0.8","v0.7","v0.6","v0.5.2","v0.5.1","v0.5","v0.4","v0.3","v0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-51020.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"}]}