mher CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM mher CVE published 2026-10-12

CVE-2022-51020

CVE-2022-51020 is a cross-site request forgery vulnerability in Flower before version 2.2.0. The vulnerability is due to Tornado xsrf_cookies being disabled and the OAuth session cookie lacking SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks.