CVE-2026-7722 json
PrefectHQ prefect Health Check API health endswith improper authentication
published 2026-05-04 6 mo ago modified 2026-10-26 13 d ago also GHSA-6rr6-v7cj-mxpg , PYSEC-2026-2956 , EUVD-2026-26875
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. The patch is named e21617125335025b4b27e7d6f0ca028e8e8f3b79. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Patch / fix
- pypi prefect 3.6.22
- PrefectHQ prefect 3.6.22
- github.com/PrefectHQ/prefect@e216171 commit
- github.com/PrefectHQ/prefect#21063 pull request
- github.com/PrefectHQ/prefect#21063 pull request
- github.com/PrefectHQ/prefect/releases/tag/3.6.22 release
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | prefect | <3.6.22 |
3.6.22 |
Affected products
- PrefectHQ prefect
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
github.com
/PrefectHQ/prefect/pull/21063
issue-tracking, patch, web
-
github.com
/PrefectHQ/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79
patch, web
-
github.com
/PrefectHQ/prefect/releases/tag/3.6.22
patch, web
-
github.com
/PrefectHQ/prefect/pull/21063/changes/d8c4ff97ef7c0a940925d32b2d76324c8def42de
web
-
gist.github.com
/nedlir/f576abbb0e491dc9bb7e106c140dda04
exploit, web
-
vuldb.com
/vuln/360898
vdb-entry, technical-description, web
-
vuldb.com
/vuln/360898/cti
signature, permissions-required, web
-
vuldb.com
/submit/807255
third-party-advisory, web
-
github.com
/PrefectHQ/prefect/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-7722
advisory
-
github.com
/PrefectHQ/prefect
package
-
pypi.org
/project/prefect
package
-
github.com
/advisories/GHSA-6rr6-v7cj-mxpg
advisory
Sources
- CVE List CVE-2026-7722
- GitHub Advisory GHSA-6rr6-v7cj-mxpg
- NVD CVE-2026-7722
- OSV PYSEC-2026-2956
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.