Advisoriesby IbisPrefectGHSA-4v9f-r55g-g6hc
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
Fix: upgrade to 2.20.17 or later (2 fixed versions below)
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| prefect PyPI | >= 3.0.0rc1, < 3.0.3 | 3.0.3 |
| < 2.20.17 | 2.20.17 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-346
- Also known as
- CVE-2024-8183, PYSEC-2026-1800
- nvd.nist.gov/vuln/detail/CVE-2024-8183
- github.com/PrefectHQ/prefect/issues/15074
- github.com/PrefectHQ/prefect/commit/8f159b404126d93964a4daace7619bc553fa318c
- github.com/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
- github.com/PrefectHQ/prefect
- github.com/PrefectHQ/prefect/releases/tag/2.20.17
- huntr.com/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2
More Prefect advisories
All Prefect
Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'CVE-2026-3514fixed in 3.6.22.dev7Prefect has an Argument Injection issueCVE-2026-3515no fix yetPrefect Git Argument Injection in GitRepository Pull StepsCVE-2026-7725fixed in 3.6.25.dev7Prefect SSRF Bypass via DNS Rebinding in validate_restricted_urlCVE-2026-7724fixed in 3.6.28.dev2Prefect Unauthenticated Event Injection via /api/events/in WebSocketCVE-2026-7723fixed in 3.6.14Prefect Auth Bypass via endswith() Health Check ExemptionCVE-2026-7722fixed in 3.6.22