PYSEC-2026-1799
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/prefect/PYSEC-2026-1799.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1799
- Aliases
- Published
- 2026-07-07T11:45:27.154429Z
- Modified
- 2026-07-07T17:48:06.320684877Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Cross-Site Request Forgery vulnerability in Prefect
- Details
-
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2023-6022
- https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3
- https://github.com/PrefectHQ/prefect/blob/main/RELEASE-NOTES.md#release-2165
- https://github.com/prefecthq/prefect
- https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af
- https://pypi.org/project/prefect
- https://github.com/advisories/GHSA-4hh5-2678-83fx
Affected packages
PyPI / prefect
Package
- Name
- prefect
- View open source insights on deps.dev
- Purl
- pkg:pypi/prefect
Affected versions
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.9.0
2.10.0
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.10.8
2.10.9
2.10.10
2.10.11
2.10.12
2.10.13
2.10.14
2.10.15
2.10.16
2.10.17
2.10.18
2.10.19
2.10.20
2.10.21
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.12.0
2.12.1
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.14.0
2.14.1
2.14.2
2.14.3
2.14.4
2.14.5
2.14.6
2.14.8
2.14.9
2.14.10
2.14.11
2.14.12
2.14.13
2.14.14
2.14.15
2.14.16
2.14.17
2.14.18
2.14.19
2.14.20
2.14.21
2.15.0
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4