CVE-2026-100418 — Flame through 2.4.0 Information Exposure via GET /api/config
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field red…
Published: 2026-09-25 · CVSS: 6.9 · CVSS 4.0
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7