CVE-2026-7723 json
PrefectHQ prefect WebSocket Endpoint in missing authentication
published 2026-05-04 6 mo ago modified 2026-10-26 13 d ago also GHSA-hvph-5985-r63v , PYSEC-2026-2958 , EUVD-2026-26877
- cvss
- 7.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 36%
- public exploits
- 0
- none known
Summary
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Patch / fix
- pypi prefect 3.6.14
- PrefectHQ prefect 3.6.14
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.42% chance of exploitation in the next 30 days, higher than 36% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- gist.github.com https://gist.github.com/nedlir/f1ab8aa038aafbcc6beeef21fab1d74f referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 3.0 | 7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C |
| CNA | 4.0 | 5.5 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | prefect | <3.6.14 |
3.6.14 |
Affected products
- PrefectHQ prefect
Classification
References
-
github.com
/PrefectHQ/prefect/pull/20372
issue-tracking, patch, web
-
github.com
/PrefectHQ/prefect/commit/f8afecadf88ea5f73694dafa3a365b9d8fae1ad6
patch, web
-
github.com
/PrefectHQ/prefect/releases/tag/3.6.14
patch, web
-
github.com
/PrefectHQ/prefect/commit/0d3ab3c2d3f9f98abfafdf7b9f6d4f8ed3925e40
web
-
gist.github.com
/nedlir/f1ab8aa038aafbcc6beeef21fab1d74f
exploit, web
-
vuldb.com
/vuln/360899
vdb-entry, web
-
vuldb.com
/vuln/360899/cti
signature, permissions-required, web
-
vuldb.com
/submit/807256
third-party-advisory, web
-
github.com
/PrefectHQ/prefect/
product
-
nvd.nist.gov
/vuln/detail/CVE-2026-7723
advisory
-
github.com
/PrefectHQ/prefect
package
-
pypi.org
/project/prefect
package
-
github.com
/advisories/GHSA-hvph-5985-r63v
advisory
Sources
- CVE List CVE-2026-7723
- GitHub Advisory GHSA-hvph-5985-r63v
- NVD CVE-2026-7723
- OSV PYSEC-2026-2958
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.