CVE-2026-100418: Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote attacker who can reach the Flame instance can send an unauthenticated request to the affected endpoint. No account, privileges, or user interaction are required.
What information can be exposed?
The endpoint returns the entire configuration object without field redaction, including the stored weather API key and internal operational settings. An attacker could use the exposed weather API key to consume provider quota.
Are default deployments affected?
The issue is in an unauthenticated GET /api/config endpoint, so deployments where that endpoint is reachable without authentication are affected. The provided data does not identify any configuration setting that disables or restricts the endpoint by default.
How can I check whether an instance is vulnerable?
From a network location that can reach the instance, request GET /api/config without authentication. If the response returns the configuration object or includes sensitive fields such as a weather API key, the instance is exposed.