PT-2023-32482 · Prefect · Prefect

Bunchesofdonald · Published 2023-11-16 · Updated 2026-05-21 · CVE-2023-6022

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions prefect versions prior to 2.16.5

Description The issue allows an attacker to steal secrets and potentially gain remote code execution via Cross-Site Request Forgery (CSRF) using the Prefect API. This can be exploited in self-hosted, open source Prefect API setups.

Recommendations For versions prior to 2.16.5, update to version 2.16.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Prefect API to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2023-6022

GHSA-4HH5-2678-83FX

Affected Products

Prefect

References · 10

• 🔥 https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af · Exploit
• https://osv.dev/vulnerability/CVE-2023-6022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4hh5-2678-83fx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6022 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-6022 · Vendor Advisory
• https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3 · Note
• https://github.com/prefecthq/prefect · Note
• https://github.com/PrefectHQ/prefect/blob/main/RELEASE-NOTES.md#release-2165 · Note
• https://t.me/cvenotify/61128 · Telegram Post
• https://t.me/cvenotify/79845 · Telegram Post