The vulnerability in Flower allows a cross‑site request forgery attack (CWE‑352) because its underlying Tornado framework has xsrf_cookies disabled and the OAuth session cookie does not enforce SameSite. An attacker can lure an authenticated user to a malicious page that posts to the control endpoints /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke, which gives the attacker the ability to shut down Celery workers, resize worker pools, and revoke scheduled tasks. This can lead to interruption of background job processing and service unavailability for the affected system.

The issue affects the Flower web interface for Celery, provided by mher:flower, in all versions prior to 2.2.0. Anyone using a version older than 2.2.0 is potentially vulnerable if the CSRF protection is not manually enabled.

With a CVSS score of 6, the vulnerability is classified as medium risk. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The attack requires that a victim user is logged into Flower and is directed to a malicious site that submits a POST request to one of the control endpoints. If successful, the attacker can cause denial of service by shutting down workers or disrupting task execution.