CVE-2026-7722

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

CVE-2026-7722 PrefectHQ prefect Health Check API health endswith improper authentication

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

CVE-2026-7722 PrefectHQ prefect Health Check API health endswith improper authentication

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...

Prefect 竞争条件问题漏洞

Prefect is a workflow orchestration tool developed by Prefect OpenSource, enabling developers to build, monitor data pipelines, and respond to changes in those pipelines. Prefect versions 3.6.28.dev1 and earlier contained a race condition vulnerability. This vulnerability stemmed from a problem...

Prefect 注入漏洞

Prefect is a workflow orchestration tool developed by Prefect OpenSource. It enables developers to build, monitor data pipelines, and respond to changes in those pipelines. Prefect versions 3.6.25.dev6 and earlier have a vulnerability due to an unknown feature in the GitRepository Pull Handler...

Prefect 授权问题漏洞

Prefect is a workflow orchestration tool developed by Prefect OpenSource, enabling developers to build, monitor data pipelines, and respond to changes in those pipelines. Prefect versions 3.6.21 and earlier have a vulnerability related to authorization. This vulnerability stems from improper...

Prefect 授权问题漏洞

Prefect is a workflow orchestration tool developed by Prefect OpenSource, enabling developers to build, monitor data pipelines, and respond to changes in those pipelines. Prefect versions 3.6.13 and earlier have a vulnerability related to authorization. This vulnerability stems from an unknown...

PT-2026-36755

Name of the Vulnerable Software and Affected Versions PrefectHQ prefect versions prior to 3.6.25.dev7 Description An argument injection issue exists in the GitRepository Pull Handler component within the src/prefect/runner/storage.py file. Remote attackers can exploit this by manipulating the...

GHSA-V92G-XGXW-VVMM vulnerabilities

Vulnerabilities for packages: pgadmin4-fips, superset, airflow-core, mlflow, jupyter-base-notebook, dagster, open-webui, airflow, prefect-fips, dagster-fips, nemo...

CVE-2026-34444 vulnerabilities

Vulnerabilities for packages: prefect, prefect-fips...

GHSA-69V7-XPR6-6GJM vulnerabilities

Vulnerabilities for packages: prefect, prefect-fips...

Unsafe cloudpickle deserialization in Prefect task runners and bundle deserialization

This report is not public...

Authentication Bypass via endswith() Health Check Exemption Allows Unauthenticated Access to Variables/Secrets in prefecthq/prefect

Description When PREFECTSERVERAPIAUTHSTRING is configured, Prefect Server's authentication middleware exempts any URL path ending with "health" or "ready" to allow health check probes. However, multiple API endpoints accept user-controlled string names as URL path parameters e.g.,...

CVE-2023-6022 vulnerabilities

Vulnerabilities for packages: prefect...

GHSA-4HH5-2678-83FX vulnerabilities

Vulnerabilities for packages: prefect...

EUVD-2023-2878

Malicious code in bioql PyPI...

CVE-2024-8183

A CORS Cross-Origin Resource Sharing misconfiguration in prefecthq/prefect version 2.20.2 allows unauthorized domains to access sensitive data. This vulnerability can lead to unauthorized access to the database, resulting in potential data leaks, loss of confidentiality, service disruption, and...

Origin Validation Error

Overview prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Origin...

PT-2025-12222

Name of the Vulnerable Software and Affected Versions prefecthq/prefect version 2.20.2 Description A CORS Cross-Origin Resource Sharing misconfiguration allows unauthorized domains to access sensitive data, potentially leading to unauthorized access to the database. This can result in data leaks,...

Prefect 访问控制错误漏洞

Prefect is a workflow orchestration tool from Prefect Open Source that enables developers to build, observe and react to data pipelines. An access control error vulnerability exists in Prefect version 2.20.2 that stems from a CORS misconfiguration that allows unauthorized domains to access...