Vulnerability PYSEC-2026-1800
High Risk
HIGH RISK
CVSS Score: 7.6
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 07, 2026 at 02:34 PM UTC
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
0.5.0 - 2.20.16 and 3.0.0rc1 - 3.0.2
0.5.0 - 2.20.16 and 3.0.0rc1 - 3.0.2
Summary
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
Details
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 months ago
Prefect has an Argument Injection issue
0.5.0 - 3.6.18 PYSEC-2026-2957
0.5.0 - 3.6.18 PYSEC-2026-2957
Medium Risk
3 months ago
Prefect Git Argument Injection in GitRepository Pull Steps
0.5.0 - 3.6.25.dev6 PYSEC-2026-2955
0.5.0 - 3.6.25.dev6 PYSEC-2026-2955
Medium Risk
3 months ago
Prefect Auth Bypass via endswith() Health Check Exemption
0.5.0 - 3.6.22.dev8 PYSEC-2026-2956
0.5.0 - 3.6.22.dev8 PYSEC-2026-2956
High Risk
3 months ago
Prefect Unauthenticated Event Injection via /api/events/in WebSocket
0.5.0 - 3.6.14.dev7 PYSEC-2026-2958
0.5.0 - 3.6.14.dev7 PYSEC-2026-2958
Medium Risk
3 months ago
Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
0.5.0 - 3.6.28.dev1 PYSEC-2026-2959
0.5.0 - 3.6.28.dev1 PYSEC-2026-2959
Impacted packages
Timeline
Published
3 months ago
July 07, 2026 at 02:34 PM UTC
Fixed (3.0.3)
2 years ago
September 20, 2024 at 02:09 PM UTC
Fixed (2.20.17)
1 year ago
March 21, 2025 at 08:44 PM UTC
Last Modified
3 months ago
July 07, 2026 at 05:48 PM UTC