CVE-2024-8183 json
CORS Misconfiguration in prefecthq/prefect
published last yr. modified 4mo ago also GHSA-4v9f-r55g-g6hc , PYSEC-2026-1800 , EUVD-2025-6931
- cvss
- 7.6
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 8%
- public exploits
- 0
- none known
Summary
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
Patch / fix
- pypi prefect 2.20.17, 3.0.3
- prefecthq prefecthq/prefect 3.0.3
Is CVE-2024-8183 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.18% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L |
| OSV | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L |
| GitHub | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | prefect | >=3.0.0rc1, <3.0.3 <2.20.17 |
3.0.3 2.20.17 |
Affected products
- prefecthq prefecthq/prefect
Classification
- Weakness
-
- CWE-346 Origin Validation Error
References
-
github.com
/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
web
-
github.com
/PrefectHQ/prefect/commit/8f159b404126d93964a4daace7619bc553fa318c
web
-
huntr.com
/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-8183
advisory
-
github.com
/PrefectHQ/prefect/issues/15074
web
-
github.com
/PrefectHQ/prefect
package
-
github.com
/PrefectHQ/prefect/releases/tag/2.20.17
web
-
pypi.org
/project/prefect
package
-
github.com
/advisories/GHSA-4v9f-r55g-g6hc
advisory
Sources
- CVE List CVE-2024-8183
- GitHub Advisory GHSA-4v9f-r55g-g6hc
- NVD CVE-2024-8183
- OSV PYSEC-2026-1800
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.