GHSA-6rr6-v7cj-mxpg

Prefect Auth Bypass via endswith() Health Check Exemption

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-7722

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	prefect	< 3.6.22	3.6.22

Details

As written in the advisory (Markdown source, shown as plain text).

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. Upgrading the affected component is recommended.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-7722 advisory
https://github.com/PrefectHQ/prefect/pull/21063 web
https://github.com/PrefectHQ/prefect/pull/21063/changes/d8c4ff97ef7c0a940925d32b2d76324c8def42de web
https://github.com/PrefectHQ/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79 web
https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04 web
https://github.com/PrefectHQ/prefect package
https://github.com/PrefectHQ/prefect/releases/tag/3.6.22 web
https://vuldb.com/submit/807255 web
https://vuldb.com/vuln/360898 web
https://vuldb.com/vuln/360898/cti web