High severity · published Mar 20, 2025
CVE-2024-8183
CORS Misconfiguration in prefecthq/prefect
7.6
CVSS
0.2%
EPSS
No
On KEV
Description
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
prefecthq/prefect · prefecthq
before 3.0.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8183
github.com
https://github.com/prefecthq/prefect/commit/a69266e077169b8a32ad76b1dd3ea63b96d011c2
huntr.com
https://huntr.com/bounties/b801de43-ff9f-4db9-b583-4797d4f7d3d2
More from prefecthq/prefect
9.9
CVE-2026-5366
Git Argument Injection in prefecthq/prefect
8.5
CVE-2026-3515
Argument Injection in prefecthq/prefect
7.5
CVE-2026-3514
Authentication Bypass in prefecthq/prefect