What’s Vulnerable › Vulnerabilities

CVE-2024-8183: CORS Misconfiguration in prefecthq/prefect

• Severity: high (CVSS 7.6 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-346

Description

A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.

Affected products

• prefecthq/prefect: before 3.0.3 — fixed in 3.0.3

How to fix

Upgrade to a fixed version: prefecthq/prefect 3.0.3. Check the vendor advisory for mitigations.

References

• https://github.com/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
• https://huntr.com/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2

Get alerted when CVE-2024-8183 or the next vulnerability affects your stack