{"id":"CVE-2023-6022","aliases":["GHSA-4hh5-2678-83fx","PYSEC-2026-1799"],"title":"Cross-Site Request Forgery vulnerability in Prefect","summary":"Cross-Site Request Forgery vulnerability in Prefect","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","vendor":"prefect","product":"prefect","ecosystem":"pip","affected":["prefect >= 2.0.0, < 2.16.5"],"patched":["prefect 2.16.5"],"published":"2023-11-16","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:03.999929474Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-4hh5-2678-83fx","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6022"},{"url":"https://github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3"},{"url":"https://github.com/PrefectHQ/prefect/blob/main/RELEASE-NOTES.md#release-2165"},{"url":"https://github.com/prefecthq/prefect"},{"url":"https://huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af"}],"tags":["osv","pip"],"epss":0.00389,"epssPercentile":0.32741,"ingestedAt":"2026-07-08T18:25:45.495Z","slug":"CVE-2023-6022","body":"## Overview\n\nAn attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.\n\n## Affected packages\n\n- `prefect >= 2.0.0, < 2.16.5`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `prefect 2.16.5`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}