CVE-2022-30034

HighCVSS 8.6

Published: 02/06/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.00%

59th percentile - higher than 59% of all known CVEs

Summary

A vulnerability in Flower, a web UI for the Celery framework, allows bypassing OAuth authentication. An attacker can access the Flower API to invoke arbitrary Celery RPC calls or shut down task nodes, causing denial of service.

Risk Assessment

The organization is at risk of unauthorized access to the task queuing system, potentially leading to unwanted operations or disruption of critical business processes.

Recommendation

Immediately update Flower to the latest patched version. If an update is not possible, restrict access to the Flower interface to trusted networks only.

Other vulnerabilities in Flower

CVE-2022-51020Medium
Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.

Original NVD description (English source)

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS