Read the docs
TI-2026-06805 Aliases CVE-2026-7723GHSA-hvph-5985-r63v

PrefectHQ prefect WebSocket Endpoint in missing authentication

Priority HIGH 70CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00421 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed prefect (PrefectHQ): 3.6.14prefect (PyPI): 3.6.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
PrefectHQprefect3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; 3.6.6; 3.6.7; 3.6.8; 3.6.9; 3.6.10; 3.6.11; 3.6.12; 3.6.133.6.14Patch availableCNA
—prefect (PyPI)before 3.6.143.6.14Patch availableGHSA-hvph-5985-r63v
  • prefect VendorPrefectHQ Affected 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; 3.6.6; 3.6.7; 3.6.8; 3.6.9; 3.6.10; 3.6.11; 3.6.12; 3.6.13 Fixed in 3.6.14 Patch available CNA
  • prefect (PyPI) Vendor— Affected before 3.6.14 Fixed in 3.6.14 Patch available GHSA-hvph-5985-r63v

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:prefect:prefect:*:*:*:*:*:*:*:*——PrefectHQ
  • cpe:2.3:a:prefect:prefect:*:*:*:*:*:*:*:* Versions — — ·PrefectHQ

Remediation

  • Fix · CNA prefect (PrefectHQ) Fixed in 3.6.14
  • Fix · GHSA-hvph-5985-r63v prefect (PyPI) Fixed in 3.6.14 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7723
  2. 2026-10-03 Alias added: GHSA-hvph-5985-r63v
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 3

Advisory 1

Other 3

  • TI-2026-25332 FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability CVSS 4.0CRITICAL 10.0
  • TI-2026-04695 Git Argument Injection in prefecthq/prefect CVSS 3.0CRITICAL 9.9
  • TI-2026-03027 Authentication Bypass in prefecthq/prefect CVSS 3.0HIGH 7.5
  • TI-2026-06804 PrefectHQ prefect Health Check API health endswith improper authentication CVSS 4.0MEDIUM 6.9
  • TI-2024-07590 CORS Misconfiguration in prefecthq/prefect CVSS 3.0HIGH 7.6
  • TI-2026-06807 PrefectHQ prefect GitRepository Pull storage.py argument injection CVSS 4.0MEDIUM 5.3
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences