---
id: CVE-2022-30034
title: >-
  Flower, a web UI for the Celery Python RPC framework, all versions as of
  05-02-2022 is vulnerable to an OAuth authentication bypass
summary: >-
  Flower, a web UI for the Celery Python RPC framework, all versions as of
  05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could
  then access the Flower API to discover and invoke arbitrary Celery RPC calls
  or deny s…
severity: high
cvss: 8.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'
cwe:
  - CWE-287
vendor: flower_project
product: flower
affected:
  - flower < 1.2.0
patched:
  - flower 1.2.0
published: '2022-06-02'
updated: '2026-07-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2022-30034'
references:
  - url: 'https://github.com/mher/flower/issues/1217'
    label: cve@mitre.org
  - url: 'https://tprynn.github.io/2022/05/26/flower-vulns.html'
    label: cve@mitre.org
  - url: 'http://githubcommherflower.com'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/mher/flower/issues/1217'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://tprynn.github.io/2022/05/26/flower-vulns.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.01057
epssPercentile: 0.62956
ingestedAt: '2026-07-06T17:03:24.397Z'
---

## Overview

Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.

## Affected

- `flower < 1.2.0`

## Remediation

Upgrade past the affected range:

- `flower 1.2.0`