Prefect CVE-2026-7723

Exploitation requires that the target Prefect instance has API authentication configured (the auth_string setting is non-null). Deployments without authentication enabled are unaffected due to legacy mode compatibility logic in the patched version. The WebSocket endpoint must be network-accessible to the attacker (default on local/internal networks for self-hosted Prefect; may be exposed in cloud deployments). No special user interaction is required-pure remote unauthenticated exploitation is possible. The vulnerability does not require compromised credentials, valid user accounts, or elevated privileges. If the Prefect instance explicitly disables API authentication, this vulnerability cannot be exploited because the server falls back to legacy mode that accepts unauthenticated connections by design.

CVSS 5.5 with network vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) indicates a straightforward network-based attack requiring no special circumstances. The vector specifies low confidentiality (VC:L), integrity (VI:L), and availability (VA:L) impact with no scope change, and the 'E:P' tag indicates publicly available exploit code. CISA KEV status is not explicitly provided, but combined with confirmed public exploit availability (GitHub Gist), active exploitation risk is elevated. The authentication bypass classification (CWE-306) combined with remote network access creates meaningful risk for Prefect deployments with authentication configured. However, the moderate CVSS score and low individual impact metrics (L/L/L) suggest this is likely exploitable for reconnaissance or limited unauthorized event injection rather than full system compromise. The vulnerability appears targetable only against Prefect instances with API authentication enabled-default deployments without auth configured are unaffected per the patch logic ('legacy mode'). Real-world priority depends on whether target Prefect instance has authentication configured and network exposure of the events endpoint.

An attacker on the network (or remote if the WebSocket endpoint is publicly exposed) establishes a WebSocket connection to the /api/events/in endpoint without providing authentication credentials. In vulnerable versions, the server accepts the connection immediately without requiring an auth handshake, allowing the attacker to send crafted event messages that are processed by the Prefect server as if from an authenticated client. The attacker could inject false workflow events, corrupt audit logs, or trigger unintended workflow executions depending on event handling logic.