CVE-2026-100418 describes an information exposure vulnerability in the pawelmalak flame product up to and including version 2.4.0. The unauthenticated GET /api/config endpoint returns the full configuration object without redacting sensitive fields, enabling attackers to access sensitive data like weather API keys and internal operational settings by sending a single unauthenticated request. This vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level. There is no indication of known exploits in the wild or vendor-provided patches.

Attackers can retrieve sensitive configuration data, including API keys and internal settings, without authentication. This exposure can lead to unauthorized use of external service quotas and potential leakage of operational details. The vulnerability does not require privileges or user interaction and has a low complexity of attack, but the impact is limited to information disclosure without direct system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the /api/config endpoint and monitor for unauthorized requests. Consider implementing authentication or filtering to prevent unauthenticated access to sensitive configuration data.