CVE-2026-100418

Received Received - Intake

Flame through Information Exposure via Unauthenticated API Endpoint

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: VulnCheck

Description

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-100418

Affected Vendors & Products

Vendor	Product	Version / Range
flame	flame	2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Flame through version 2.4.0 has an information exposure flaw in the unauthenticated GET /api/config endpoint. This endpoint returns the entire configuration object without hiding sensitive fields like API keys or internal settings. Attackers can exploit this by sending a single unauthenticated request to access sensitive data such as weather API keys or operational configurations.

Detection Guidance

To detect this vulnerability, check if Flame 2.4.0 is running and if the unauthenticated GET /api/config endpoint is accessible. Use curl to send a request to the endpoint and inspect the response for sensitive data like API keys or configuration details.

Impact Analysis

An attacker could use this flaw to retrieve your weather API key, which might lead to unauthorized usage of the API service, increased costs, or service disruption. They could also access internal operational settings, potentially revealing details about your system's configuration or workflows.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if sensitive data like API keys or internal settings are exposed. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. Unauthorized access to such data may result in legal penalties or data breach notifications.

Mitigation Strategies

Immediately upgrade Flame to a version that fixes this vulnerability. If an upgrade is not available, restrict access to the /api/config endpoint by implementing authentication or network-level controls to block unauthenticated requests.

Hi! I’m here to help you understand CVE-2026-100418. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70