Prefect vulnerabilities
We track 2 vulnerabilities in Prefect products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 20, 2026.
2vulnerabilities
1critical
1high
0exploited
8.7average CVSS score
Latest Prefect vulnerabilities
- 9.9 Critical severity
prefecthq/prefect: Improper Control of Generation of Code
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the `GitRepository` storage class. The `commit_sha` parameter, which is passed to git commands, lacks validation and does not include a `--` sepa
- 7.5 High severity
prefecthq/prefect: Incorrect Authorization
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready'