AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

PrefectGHSA-4hh5-2678-83fx

Cross-Site Request Forgery vulnerability in Prefect

Prefect

CVE-2023-6022 · Published Nov 16, 2023 · updated Sep 10, 2026

High8.8
Fix: upgrade to 2.16.5 or later
GitHub advisory

An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.

Affected versions

PackageAffectedFixed in
prefect
PyPI
>= 2.0.0, < 2.16.52.16.5
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-352
Also known as
CVE-2023-6022, PYSEC-2026-1799

More Prefect advisories

All Prefect
High 8.5May 26Prefect has an Argument Injection issueCVE-2026-3515no fix yetLow 6.3May 4Prefect Git Argument Injection in GitRepository Pull StepsCVE-2026-7725fixed in 3.6.25.dev7Low 5.0May 4Prefect SSRF Bypass via DNS Rebinding in validate_restricted_urlCVE-2026-7724fixed in 3.6.28.dev2Medium 7.3May 4Prefect Unauthenticated Event Injection via /api/events/in WebSocketCVE-2026-7723fixed in 3.6.14Medium 5.3May 4Prefect Auth Bypass via endswith() Health Check ExemptionCVE-2026-7722fixed in 3.6.22High 7.6Mar 20, 2025Prefect CORS (Cross-Origin Resource Sharing) misconfigurationCVE-2024-8183fixed in 2.20.17 +1