CVE-2026-3514 Details
Description
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.
A vulnerability allowing authentication bypass has been identified in Prefect version 3.6.19. The issue arises from improper handling of URL path exemptions for health check probes, which allows unauthenticated access to certain API endpoints. The authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This vulnerability enables an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This flaw can lead to unauthorized access to sensitive information stored in Prefect Variables, such as API keys and database credentials.
Users can update to Prefect version 3.6.22 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://huntr.com/bounties/c540e5e1-f74f-44f4-bfa0-9764ff6daa75 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/prefecthq/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79 | [email protected] | Patch |
| https://huntr.com/bounties/c540e5e1-f74f-44f4-bfa0-9764ff6daa75 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| prefect prefect | < 3.6.22 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |