AVID-2026-R1613

Description

CORS Misconfiguration in prefecthq/prefect (CVE-2024-8183)

Details

A CORS (Cross-Origin Resource Sharing) misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and data integrity risks.

Reason for inclusion in AVID: CVE-2024-8183 describes a CORS misconfiguration in prefecthq/prefect that can allow unauthorized domains to access sensitive data. Prefect is a workflow/orchestration tool widely used to build, deploy, and run AI/ML pipelines, making this vulnerability relevant to AI systems and their software stack. It constitutes a security vulnerability with potential data exposure, and the report provides explicit CVE details, impact, and references, supporting its inclusion in AI software supply chain curation.

References

Affected or Relevant Artifacts

Developer: prefecthq
Deployer: prefecthq
Artifact Details:

Type	Name
System	prefecthq/prefect

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
Base Score	7.6
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	NONE
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🟢 Low
Availability Impact	🟢 Low

CWE

ID	Description
CWE-346	CWE-346 Origin Validation Error

Other information

Report Type: Advisory
Credits:
Date Reported: 2025-03-20
Version: 0.3.3
AVID Entry