Prefect CVE-2026-7722

Authentication must be enabled on the Prefect server via the PREFECT_SERVER_API_AUTH_STRING configuration setting. The Health Check API middleware is active in versions 3.6.21 and earlier. Exploitation requires only network access to the Prefect API server and does not require valid credentials, specific deployment mode, or user interaction. The vulnerability is exploitable against default configurations where authentication is configured but the middleware logic is flawed. Non-authenticated Prefect deployments (without PREFECT_SERVER_API_AUTH_STRING set) are not vulnerable since no authentication logic is invoked.

CVSS 5.5 (AV:N/AC:L/PR:N/UI:N/VC:L) indicates network-accessible authentication bypass with low complexity, no privileges required, and confidentiality impact only. EPSS score not provided, but the presence of publicly available exploit code combined with the straightforward nature of the attack (path manipulation via HTTP requests) suggests moderate real-world risk. The vulnerability is not in CISA KEV status at time of analysis, but public exploit availability lowers the barrier to exploitation. The technical impact is contained - attackers gain only unauthenticated read access to health status endpoints, not administrative capabilities. However, in environments where Prefect server is exposed to untrusted networks and health endpoint exposure is considered sensitive (e.g., information disclosure about system state), this represents a legitimate authentication control failure. Organizations with authentication enabled on Prefect deployments should treat this as medium priority given the low complexity and public POC, but the limited scope (health endpoints only, no data modification) prevents this from being critical.

An attacker with network access to an unauthenticated Prefect server deployment crafts an HTTP GET request to /api/variables/name/system-health or similar path ending in "health". The vulnerable suffix matching logic incorrectly permits this request through the authentication middleware, returning health status information that would normally require authentication. Alternatively, the attacker sends a request to a protected endpoint (e.g., /api/version) with a crafted Host header value of "localhost/health?" that causes request.url.path to be reconstructed as /health, bypassing authentication checks while the actual endpoint served remains protected. A published proof-of-concept demonstrates this technique.