Prefect (Python) – Support, CVEs & Health

GHSA-4hh5-2678-83fx CVSS_V3

Cross-Site Request Forgery vulnerability in Prefect

Published: 2023-11-16 Fixed in: 2.16.5

GHSA-4v9f-r55g-g6hc CVSS_V3

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

Published: 2025-03-20 Fixed in: 3.0.3

GHSA-6rcx-55r6-jx65 CVSS_V3

Prefect Git Argument Injection in GitRepository Pull Steps

Published: 2026-05-04 Fixed in: 3.6.25.dev7

GHSA-6rr6-v7cj-mxpg CVSS_V3

Prefect Auth Bypass via endswith() Health Check Exemption

Published: 2026-05-04 Fixed in: 3.6.22

GHSA-c635-393c-hcx2 CVSS_V3

Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

Published: 2026-06-02 Fixed in: 3.6.22.dev7

GHSA-cw25-2p92-7f75 CVSS_V3

Prefect has an Argument Injection issue

Published: 2026-05-26 No fix available

GHSA-hvph-5985-r63v CVSS_V3

Prefect Unauthenticated Event Injection via /api/events/in WebSocket

Published: 2026-05-04 Fixed in: 3.6.14

GHSA-p3pq-hxmr-vqqr CVSS_V3

Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

Published: 2026-05-04 Fixed in: 3.6.28.dev2

PYSEC-2026-1799 CVSS_V3

Cross-Site Request Forgery vulnerability in Prefect

Published: 2026-07-07 Fixed in: 2.16.5

PYSEC-2026-1800 CVSS_V3

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

Published: 2026-07-07 Fixed in: 2.20.17

Prefect