CORS misconfiguration in Prefect server (CVE-2024-8183)
Prefect's server software was configured with overly permissive CORS settings that allowed cross-origin requests from any source. The vulnerability was remediated by making CORS policies configurable through environment variables.
What happened
Prefect's server had Cross-Origin Resource Sharing (CORS) middleware configured with wildcard defaults that allowed requests from any origin, any HTTP method, and any headers.
Governance controls
PrefectHQ added configuration settings to make CORS policies controllable via environment variables (PREFECT_SERVER_CORS_ALLOWED_ORIGINS, PREFECT_SERVER_CORS_ALLOWED_METHODS, PREFECT_SERVER_CORS_ALLOWED_HEADERS) instead of hardcoded wildcards.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.