PrefectGHSA-4v9f-r55g-g6hc
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
High7.6CVE-2024-8183 · Published Mar 20, 2025 · updated Jul 7, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| prefect PyPI | >= 3.0.0rc1, < 3.0.3 | 3.0.3 |
| < 2.20.17 | 2.20.17 |
Details and references
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-346
- Also known as
- CVE-2024-8183, PYSEC-2026-1800
- nvd.nist.gov/vuln/detail/CVE-2024-8183
- github.com/PrefectHQ/prefect/issues/15074
- github.com/PrefectHQ/prefect/commit/8f159b404126d93964a4daace7619bc553fa318c
- github.com/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
- github.com/PrefectHQ/prefect
- github.com/PrefectHQ/prefect/releases/tag/2.20.17
- huntr.com/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2
More Prefect advisories
All Prefect| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 4 | Prefect Auth Bypass via endswith() Health Check Exemption CVE-2026-7722Medium5.3fixed in 3.6.22 | Medium5.3 | 3.6.22 |
| May 4 | Prefect Unauthenticated Event Injection via /api/events/in WebSocket CVE-2026-7723Medium7.3fixed in 3.6.14 | Medium7.3 | 3.6.14 |
| May 4 | Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url CVE-2026-7724Low5.0fixed in 3.6.28.dev2 | Low5.0 | 3.6.28.dev2 |
| May 4 | Prefect Git Argument Injection in GitRepository Pull Steps CVE-2026-7725Low6.3fixed in 3.6.25.dev7 | Low6.3 | 3.6.25.dev7 |
| May 26 | Prefect has an Argument Injection issue CVE-2026-3515High8.5no fix yet | High8.5 | No fix yet |
| Jun 2 | Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready' CVE-2026-3514High7.5fixed in 3.6.22.dev7 | High7.5 | 3.6.22.dev7 |