omnipy (>=0.15.3, <=0.15.12), omnipy-examples (>=0.6.5, <=0.6.8) potentially affected by CVE-2026-7722 via prefect (2.13.8)

prefect PYPI version 2.13.8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - omnipy =0.15.3, =0.6.5, =0.6.8 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

datafetch (>=0.0.1, <=0.0.2) potentially affected by CVE-2026-7722 via prefect (0.14.6)

prefect PYPI version 0.14.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - datafetch =0.0.1, =0.0.2 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

edx-prefectutils (>=2.0.1, <=2.3.8) potentially affected by CVE-2026-7722 via prefect (0.15.1)

prefect PYPI version 0.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =2.0.1, =2.3.8 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

prefect-ds (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-7722 via prefect (0.9.2)

prefect PYPI version 0.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - prefect-ds =0.1.0, =0.1.1 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

soam (>=0.3.5, <=0.10.1) potentially affected by CVE-2026-7722 via prefect (0.14.17)

prefect PYPI version 0.14.17 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - soam =0.3.5, =0.10.1 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

aporacle (>=0.0.126, <=0.0.143), komoutils (>=0.0.217, <=0.0.224) potentially affected by CVE-2026-7722 via prefect (2.10.0)

prefect PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - aporacle =0.0.126, =0.0.217, =0.0.224 Source cves: CVE-2026-7722 Source advisory: OSV:PYSEC-2026-2956...

PYSEC-2026-2956 Prefect Auth Bypass via endswith() Health Check Exemption

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

PT-2026-59586

A vulnerability was found in PrefectHQ prefect up to 3.6.25.dev6. Affected by this issue is some unknown functionality of the file src/prefect/runner/storage.py of the component GitRepository Pull Handler. The manipulation of the argument commit sha/directories results in argument injection. It i...

PT-2026-59588

A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...

PT-2026-59590

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate restricted url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

edx-prefectutils (>=1.0.7, <=2.0.0) potentially affected by CVE-2024-8183 via prefect (0.14.5)

prefect PYPI version 0.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =1.0.7, =2.0.0 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruptio...

omicidx (>=0.9.0.9000, <=1.0.2.0), statline-bq (0.1.0) potentially affected by CVE-2024-8183 via prefect (0.13.19)

prefect PYPI version 0.13.19 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - omicidx =0.9.0.9000, =1.0.2.0 - statline-bq 0.1.0 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

PYSEC-2026-1800 Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect prior to version 3.0.3 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruptio...

kitanaqa (0.1.0) potentially affected by CVE-2024-8183 via prefect (0.13.4)

prefect PYPI version 0.13.4 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - kitanaqa 0.1.0 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

cdp-backend (>=3.0.0.dev4, <=3.0.0.dev5) potentially affected by CVE-2024-8183 via prefect (0.14.22)

prefect PYPI version 0.14.22 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cdp-backend =3.0.0.dev4, =3.0.0.dev5 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

cmip6-downscaling (1.1.1), cupyopt (>=0.15.13.1, <=0.15.13.2) +4 more potentially affected by CVE-2024-8183 via prefect (0.15.13)

prefect PYPI version 0.15.13 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cmip6-downscaling 1.1.1 - cupyopt =0.15.13.1, =0.1.8, =0.1.0, =0.1.10a0 - soam 0.10.2 Source cves: CVE-2024-8183 Source advisory:...

viadot2 (>=2.2.9, <=2.2.20) potentially affected by CVE-2024-8183 via prefect (3.0.0rc20)

prefect PYPI version 3.0.0rc20 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - viadot2 =2.2.9, =2.2.20 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

mesiqi (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-8183 via prefect (0.15.7)

prefect PYPI version 0.15.7 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - mesiqi =0.0.1, =0.0.2 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...