CVE-2022-30034

Severity: high (CVSS 8.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-06-02 · updated 2026-07-09
Weakness: CWE-287

Description

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

Affected products

Flower Project Flower: before 1.2.0 — fixed in 1.2.0

How to fix

Upgrade to a fixed version: Flower Project Flower 1.2.0. Check the vendor advisory for mitigations.

References

https://github.com/mher/flower/issues/1217
https://tprynn.github.io/2022/05/26/flower-vulns.html
https://github.com/mher/flower/issues/1217
https://tprynn.github.io/2022/05/26/flower-vulns.html

Get alerted when CVE-2022-30034 or the next vulnerability affects your stack