CVE-2026-7722 Details
Description
A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. The patch is named e21617125335025b4b27e7d6f0ca028e8e8f3b79. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
An authentication bypass vulnerability has been identified in PrefectHQ Prefect versions prior to 3.6.22. The issue resides in the Health Check API, specifically within the 'endswith' function of the '/api/health' endpoint. This vulnerability allows improper authentication handling, which can be exploited remotely. The flaw has been publicly disclosed and is actively being exploited.
Users are advised to upgrade to Prefect version 3.6.22, which addresses the authentication bypass issue. Instructions for updating can be found in the Prefect documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 4, 2026CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04 | [email protected] | ExploitTechnical Description |
| https://github.com/PrefectHQ/prefect/ | [email protected] | ProductVendor |
| https://github.com/PrefectHQ/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79 | [email protected] | |
| https://github.com/PrefectHQ/prefect/pull/21063 | [email protected] | Issue TrackingVendor |
| https://github.com/PrefectHQ/prefect/releases/tag/3.6.22 | [email protected] | Release NotesVendor |
| https://vuldb.com/submit/807255 | [email protected] | Permission Required |
| https://vuldb.com/vuln/360898 | [email protected] | AdvisoryPermission RequiredRemedy |
| https://vuldb.com/vuln/360898/cti | [email protected] | Permission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PrefectHQ prefect | >= 3, < 3.6.22 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 4, 2026 | CVE Modified | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |