Flame CVE-2026-100418

No special conditions - remote unauthenticated exploitation against default configurations of Flame (pawelmalak self-hosted homelab dashboard) through 2.4.0: the GET /api/config route lacks authentication middleware and getConfig returns the full config without redaction. The only meaningful limits are (1) network reachability of the Flame HTTP interface - many homelab instances sit behind LANs or reverse proxies and are not internet-exposed, and (2) impact scope is bounded to whatever secrets are stored in config, primarily the weather API key and internal operational settings; if no weather API key is configured, the disclosed data is correspondingly less sensitive.

This is a genuine but low-severity issue: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N, base 6.9) confirms unauthenticated, network-reachable, single-request exploitation against default configurations, but confidentiality impact is limited (VC:L) and there is no integrity or availability impact. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not a demonstrated widely-exploited flaw. The 6.9 rating is elevated by the unauthenticated network vector rather than by impact; the practical exposure is disclosure of a stored weather (OpenWeatherMap-style) API key and internal operational settings, which enables provider-quota abuse or minor recon, not host compromise. Weighed against real-world signals, this is a low real-world priority: no active-exploitation evidence, low technical impact, and a niche self-hosted product. The primary caveat is deployment exposure - Flame is a homelab dashboard often placed behind a home network or reverse proxy, so many instances may not be internet-reachable, further reducing realistic risk.

An attacker who can reach a Flame instance's HTTP interface (e.g. an internet-exposed homelab dashboard) sends a single unauthenticated GET /api/config request and receives the full configuration object with no field redaction. They extract the stored weather API key and internal settings, then abuse the key to consume the victim's provider quota or use the leaked settings for further reconnaissance. No public exploit code is identified, but the attack is trivial - a single curl request against a default configuration.