GitHub Advisoryadvisory · PyPI

GHSA-6rr6-v7cj-mxpg Prefect Auth Bypass via endswith() Health Check Exemption

MEDIUM Published 2026-05-04 Modified 2026-05-22 Official page ↗
Aliases
CVE-2026-7722
Ecosystem
PyPI
Packages
prefect
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-287
Reviewed
2026-05-22

Affected packages

• PyPI prefect: < 3.6.22 → fixed in 3.6.22

Description

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. Upgrading the affected component is recommended.

Related

Alias · CVE (1)

  • CVE-2026-7722 A vulnerability was detected in PrefectHQ prefect up to 3.6.21. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References