CVE-2026-3514Authentication Bypass in prefecthq/prefect
Updated under an hour ago ()
Does this affect you?
It affects prefecthq/prefect and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.
- CVSS
- 7.5 HIGH (v3.0, CNA)CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- CWE-863
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- @huntr_ai
- NVD analysis
- Analyzed
- Record last updated
- Jun 2, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
prefecthq prefecthq/prefect prefecthq:prefect (from the name) | from unspecified before 3.6.22 | CNA record |
prefect prefect prefect:prefect | before 3.6.22 | NVD |
References
- https://huntr.com/bounties/c540e5e1-f74f-44f4-bfa0-9764ff6daa75exploit, third-party-advisory
- https://github.com/prefecthq/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.