CVE-2023-6022
Cross-Site Request Forgery (CSRF) in prefecthq/prefect
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Request Forgery (CSRF) in prefecthq/prefect
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
- Record
CVE-2023-6022- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
EUVDEUVD-2023-2878
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
- Record
EUVD-2023-2878- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4hh5-2678-83fx
Cross-Site Request Forgery vulnerability in Prefect
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.
- Record
GHSA-4hh5-2678-83fx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
NVD
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
- Record
CVE-2023-6022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
Cross-Site Request Forgery (CSRF) in prefecthq/prefect
Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5.
- Record
CVE-2023-6022- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVGHSA-4hh5-2678-83fx
Cross-Site Request Forgery vulnerability in Prefect
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.
- Record
GHSA-4hh5-2678-83fx- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-352
- Updated
- 2026-11-02
OSVPYSEC-2026-1799
Cross-Site Request Forgery vulnerability in Prefect
An attacker is able to steal secrets and potentially gain remote code execution via CSRF using a self-hosted, open source Prefect API.
- Record
PYSEC-2026-1799- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2023-6022
CVE-2023-6022 in prefect - Patched by Root
Root has patched CVE-2023-6022 in the prefect package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2023-6022- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
prefectPyPI |
2.0.0 up to 2.16.5 | 2.16.5 |
prefectPyPI |
2.0.0 up to 2.16.5, plus listed versions 2.0.12.0.22.0.32.0.42.1.0 Show 45 moreShow less2.1.12.10.02.10.12.10.102.10.112.10.122.10.132.10.142.10.152.10.162.10.172.10.182.10.192.10.22.10.202.10.212.10.32.10.42.10.52.10.62.10.72.10.82.10.92.11.02.11.12.11.22.11.32.11.42.11.52.12.02.12.12.13.02.13.12.13.22.13.32.13.42.13.52.13.62.13.72.13.82.14.02.14.12.14.102.14.112.14.12 |
2.16.5 |
prefectRoot:PyPI |
before 2.10.4+aikido.4 | 2.10.4+aikido.42.11.5+aikido.32.14.13+aikido.22.10.4+aikido.52.11.5+aikido.42.14.13+aikido.32.14.13+aikido.42.11.5+aikido.52.14.13+aikido.52.11.5+aikido.62.10.4+aikido.62.11.5+aikido.7 |
rootio-prefectRoot:PyPI |
before 2.10.4+root.io.2 | 2.10.4+root.io.22.10.4+root.io.32.11.5+root.io.22.10.4+root.io.42.11.5+root.io.32.14.13+root.io.22.10.4+root.io.52.11.5+root.io.42.14.13+root.io.32.14.13+root.io.42.11.5+root.io.52.14.13+root.io.52.11.5+root.io.62.10.4+root.io.62.11.5+root.io.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-6022 is a high vulnerability (CVSS 8.8) in Prefect, published November 16, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in prefect 2.16.5.
References
huntr.com/bounties/dab47d99-551c-4355-9ab1-c99cb90235af
github.com/prefecthq/prefect/commit/227dfcc7e3374c212a4bcd68b14e090b1c02d9d3
nvd.nist.gov/vuln/detail/CVE-2023-6022
pypi.org/project/prefect
Left out here: 65 versions. The JSON record has them.