CVE-2022-30034
Flower OAuth authentication bypass
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
CVE-2022-30034- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
CVE-2022-30034- Updated
- 2026-11-02
EUVDEUVD-2022-0106 No score
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
EUVD-2022-0106- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-q4qm-xhf9-4p8f
Flower OAuth authentication bypass
All versions of Flower, a web UI for the Celery Python RPC framework, as of 05-02-2022 are vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. A fix was released in version 1.2.0.
- Record
GHSA-q4qm-xhf9-4p8f- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-q4qm-xhf9-4p8f
Flower OAuth authentication bypass
All versions of Flower, a web UI for the Celery Python RPC framework, as of 05-02-2022 are vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. A fix was released in version 1.2.0.
- Record
GHSA-q4qm-xhf9-4p8f- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2022-30034
CVE-2022-30034 in rootio-flower - Patched by Root
Root has patched CVE-2022-30034 in the rootio-flower package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2022-30034- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-30034
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
UBUNTU-CVE-2022-30034- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H - Updated
- 2026-11-02
OSV No score
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
CVE-2022-30034- Updated
- 2026-11-02
OSVPYSEC-2022-42973 No score
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
- Record
PYSEC-2022-42973- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
flowerPyPI |
before 1.2.0 | 1.2.0 |
flowerPyPI |
before 1.2.0, plus listed versions 0.1.00.2.00.3.00.3.10.4.0 Show 24 moreShow less0.4.20.4.30.5.00.5.10.5.20.6.00.7.00.7.10.7.20.7.30.8.00.8.10.8.20.8.30.8.40.9.00.9.10.9.20.9.30.9.40.9.50.9.71.0.01.1.0 |
1.2.0 |
rootio-flowerRoot:PyPI |
before 1.1.0+root.io.1 | 1.1.0+root.io.11.1.0+root.io.2 |
flowerRoot:PyPI |
before 1.1.0+aikido.2 | 1.1.0+aikido.2 |
flowerUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.0+dfsg-20.8.3+dfsg-1 |
None known |
flowerUbuntu:18.04:LTS |
All versions, plus listed versions 0.8.3+dfsg-20.8.3+dfsg-2ubuntu10.8.3+dfsg-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-30034 is a high vulnerability (CVSS 8.6) in Flower Project Flower, published May 31, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in flower 1.2.0.