CVE-2024-8183 CORS Misconfiguration in prefecthq/prefect
Attackers can access sensitive data due to CORS misconfiguration, leading to potential data leaks and confidentiality loss.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-8183?
CVE-2024-8183 is a high-severity vulnerability in prefecthq/prefect, published on 20 Mar 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.
Weakness: CWE-346
Which versions are affected by CVE-2024-8183?
5 open source packages ship an affected version, including prefect.
| Package | Affected | Fixed in |
|---|---|---|
prefect PyPI | All versions | 2.20.17, 3.0.3 |
prefect PyPI | All versions | 2.20.17 |
prefect PyPI | All versions | 2.20.17 |
prefect PyPI | From 3.0.0rc1 | 3.0.3 |
prefect PyPI | From 3.0.0rc1 | 3.0.3 |
How do I fix CVE-2024-8183?
Upgrade prefect to a fixed version for your release line: 2.20.17 or 3.0.3.
Is CVE-2024-8183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-8183 exists.
Sources
Also known as GHSA-4v9f-r55g-g6hc, PYSEC-2026-1800, ROOT-APP-PYPI-CVE-2024-8183.