CVE-2022-51020

Received Received - Intake

Flower Celery CSRF via Disabled XSRF Cookies

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2022-51020

Affected Vendors & Products

Vendor	Product	Version / Range
mher	flower	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

Flower before 2.2.0 has a cross-site request forgery (CSRF) vulnerability due to disabled Tornado xsrf_cookies and missing SameSite attribute on the OAuth session cookie. Attackers can trick authenticated users into visiting malicious pages that send POST requests to endpoints like /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke, allowing them to shut down Celery workers, resize pools, or revoke tasks.

Detection Guidance

This vulnerability can be detected by checking for unauthorized POST requests to specific Flower API endpoints like /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke. Monitor logs for these paths and inspect network traffic for suspicious Celery worker management actions.

Impact Analysis

This vulnerability allows attackers to perform unauthorized actions on your Flower or Celery setup, such as shutting down workers, resizing pools, or revoking tasks. This could disrupt your Celery task processing, leading to service outages or unexpected behavior in your application.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as described. The issue involves cross-site request forgery (CSRF) in Flower before 2.2.0, allowing unauthorized actions like shutting down Celery workers or revoking tasks. Compliance impacts would depend on how the affected system is used and whether unauthorized actions could lead to data breaches or unauthorized access, which are not explicitly detailed in the provided context.

Mitigation Strategies

Upgrade Flower to version 2.2.0 or later to address the CSRF vulnerability. Ensure Tornado's xsrf_cookies is enabled and configure the OAuth session cookie with SameSite attribute to prevent unauthorized POST requests to endpoints like /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke.

Hi! I’m here to help you understand CVE-2022-51020. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70