https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-21T00:45:23.633379+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2022-51020 CVE-2022-51020 — Flower before 2.2.0 CSRF via Worker and Task Control API Endpoints 2026-10-21T00:45:23.634670+00:00

Affected: mher flower

Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.