CVE-2026-100418: Pawelmalak Flame

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Flame through 2.4.0 contains an information exposure vulnerability in the unauthenticated GET /api/config endpoint that returns the entire configuration object without field redaction. Attackers can retrieve the stored weather API key and internal operational settings by sending a single unauthenticated request to consume provider quota or access sensitive configuration data.

Affected products

• Pawelmalak Flame: up to and including 2.4.0

Published 2026-09-25. Last modified 2026-09-30.