Vulnerabilities for prefect

First version without a known vulnerability: 3.6.28.dev2

Details

• GHSA-c635-393c-hcx22026-06-02

  Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

  Fixed in: 3.6.22.dev7, 3.6.22

• GHSA-cw25-2p92-7f752026-05-26

  Prefect has an Argument Injection issue

• GHSA-6rcx-55r6-jx652026-05-04

  Prefect Git Argument Injection in GitRepository Pull Steps

  Fixed in: 3.6.25.dev7

• GHSA-6rr6-v7cj-mxpg2026-05-04

  Prefect Auth Bypass via endswith() Health Check Exemption

  Fixed in: 3.6.22

• GHSA-hvph-5985-r63v2026-05-04

  Prefect Unauthenticated Event Injection via /api/events/in WebSocket

  Fixed in: 3.6.14

• GHSA-p3pq-hxmr-vqqr2026-05-04

  Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

  Fixed in: 3.6.28.dev2

• GHSA-4v9f-r55g-g6hc2025-03-20

  Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

  Fixed in: 3.0.3, 2.20.17

• GHSA-4hh5-2678-83fx2023-11-16

  Cross-Site Request Forgery vulnerability in Prefect

  Fixed in: 2.16.5