CVE-2022-51020: Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Q: Does an attacker need their own Flower account to exploit this issue?

The described attack relies on luring an authenticated user to a malicious page. The attacker does not need to be authenticated if they can cause an authenticated user's browser to submit the request.

Q: Which actions can an attacker cause through the affected interface?

Requests can target worker shutdown, worker pool restart, and task revocation endpoints. This can shut down Celery workers, resize or restart pools, and revoke tasks.

Q: What browser-side conditions make the attack possible?

Affected versions have Tornado XSRF cookies disabled, and the OAuth session cookie lacks a SameSite attribute. These conditions allow a malicious site to induce cross-site POST requests from an authenticated user's browser.

Published Oct 12, 2026

Updated

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrfcookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

Affected Software

1 affected component

Flower Flower<2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Flower to a version that resolves this vulnerability.
Fixed in 2.2.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need their own Flower account to exploit this issue?

The described attack relies on luring an authenticated user to a malicious page. The attacker does not need to be authenticated if they can cause an authenticated user's browser to submit the request.

Which actions can an attacker cause through the affected interface?

Requests can target worker shutdown, worker pool restart, and task revocation endpoints. This can shut down Celery workers, resize or restart pools, and revoke tasks.

What browser-side conditions make the attack possible?

Affected versions have Tornado XSRF cookies disabled, and the OAuth session cookie lacks a SameSite attribute. These conditions allow a malicious site to induce cross-site POST requests from an authenticated user's browser.

CVE-2022-51020: Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints

Affected Software

Remediation

Event History

Frequently Asked Questions

Does an attacker need their own Flower account to exploit this issue?

Which actions can an attacker cause through the affected interface?

What browser-side conditions make the attack possible?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need their own Flower account to exploit this issue?

Which actions can an attacker cause through the affected interface?

What browser-side conditions make the attack possible?