CVE-2026-100418 Flame through 2.4.0 Information Exposure via GET /api/config
Unauthenticated attackers can access sensitive configuration data and API keys via the /api/config endpoint in Flame.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-100418?
CVE-2026-100418 is a medium-severity vulnerability in pawelmalak flame, published on 25 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.
Weakness: CWE-200
Which versions are affected by CVE-2026-100418?
How do I fix CVE-2026-100418?
No fix has been published for CVE-2026-100418 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-100418 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-100418 exists.
Sources
Also known as GHSA-57pv-56rc-p5hq.