Home » Database

AVID-2026-R1326

Description

Cross-Site Request Forgery (CSRF) in prefecthq/prefect (CVE-2023-6022)

Details

Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.

Reason for inclusion in AVID: CVE-2023-6022 describes a Cross-Site Request Forgery (CSRF) vulnerability in prefecthq/prefect, a widely used workflow orchestration tool in ML/AI pipelines. This is a software supply chain component (deployment/operational tooling) that AI systems commonly depend on, and the vulnerability is security-related (CSRF) with high impact. The CVE entry and references provide sufficient evidence to classify for AVID curation.

References

Affected or Relevant Artifacts

  • Developer: prefecthq
  • Deployer: prefecthq
  • Artifact Details:
TypeName
Systemprefecthq/prefect

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-352CWE-352 Cross-Site Request Forgery (CSRF)

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2023-11-16
  • Version: 0.3.3
  • AVID Entry