CVE-2023-6022: Cross-Site Request Forgery vulnerability in Prefect
Summary
CVE-2023-6022: Cross-Site Request Forgery vulnerability in Prefect. Affects prefect versions >= 2.0.0, < 2.16.5. Fixed in 2.16.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Prefect is a Python package available on PyPI that provides a framework for building, scheduling, and monitoring data workflows. It is widely used in data engineering and data science projects. The vulnerability identified as CVE-2023-6022 is a Cross-Site Request Forgery (CSRF) vulnerability that affects Prefect's API. This vulnerability allows an attacker to perform unauthorized actions on behalf of a user, potentially leading to the theft of secrets and even remote code execution.
Vulnerability Detail
The CSRF vulnerability in Prefect's API enables an attacker to trick a user into performing unintended actions without their consent. By crafting a malicious request and tricking the user into executing it, the attacker can steal sensitive information, such as secrets used in the Prefect workflows. Additionally, if the attacker gains access to the user's account, they may be able to execute arbitrary code on the affected system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.8.
How To Fix
Latest published version: 3.9.1.dev1 as of 22 Oct 2026
pip install --upgrade "prefect==3.9.1.dev1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.16.5
This is the first release that contains the fix.
pip install --upgrade "prefect==2.16.5"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is crucial to update to the latest version of the Prefect package to ensure the security of your system.
Conclusion
The CSRF vulnerability in Prefect's API poses a significant risk to the security of systems using the package. It is crucial to update to version 2.14.3 or later to mitigate this vulnerability. Failure to do so may result in the theft of sensitive information and potential remote code execution. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for prefect →
FAQ
A CSRF vulnerability allows an attacker to perform actions on behalf of a user without their consent or knowledge. It occurs when a website or application does not properly validate requests, allowing malicious actors to forge requests and trick users into executing them.
The CSRF vulnerability in Prefect can lead to the theft of sensitive information, such as secrets used in workflows. Additionally, if an attacker gains access to a user's account, they may be able to execute arbitrary code on the affected system, potentially leading to further compromise.
You can use the Vulert Playground at Vulert Scanner to check if your Prefect installation is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including CVE-2023-6022.
Yes, upgrading to version 2.14.3 or later of the Prefect package will fix the CSRF vulnerability. It is recommended to update your installation as soon as possible.
You can find more information about this vulnerability, including the technical details and the fix, in the GitHub Advisory Database at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/11/GHSA-4hh5-2678-83fx/GHSA-4hh5-2678-83fx.json
References
Related vulnerabilities
Recent vulnerabilities recorded for prefect.
