CVE-2026-7723 in prefect
Summary
by MITRE • 05/04/2026
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called 0d3ab3c2d3f9f98abfafdf7b9f6d4f8ed3925e40. It is recommended to upgrade the affected component.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/22/2026
This vulnerability resides within PrefectHQ prefect version 3.6.13 and earlier, specifically targeting the WebSocket endpoint component at /api/events/in. The flaw represents a critical authentication bypass issue that allows remote attackers to manipulate the system without proper credentials. The affected function appears to lack proper authentication checks, creating an exploitable pathway for unauthorized access to event handling mechanisms. This vulnerability is particularly concerning as it affects the core WebSocket infrastructure that handles real-time event communications within the platform.
The technical implementation of this flaw demonstrates a failure in access control validation within the WebSocket endpoint handler. The missing authentication mechanism suggests that the system does not properly verify user credentials or session tokens before processing incoming WebSocket events. This type of vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a direct violation of the principle of least privilege. The remote execution capability indicates that attackers can exploit this vulnerability from external networks without requiring physical access or prior system compromise.
The operational impact of this vulnerability extends beyond simple unauthorized access, as WebSocket endpoints typically handle real-time data streams and event notifications that may contain sensitive operational information. Attackers who successfully exploit this vulnerability could potentially intercept, modify, or inject malicious events into the system, leading to data integrity compromises and potential system disruption. The fact that an exploit has been published and is actively available increases the risk profile significantly, as it removes the requirement for advanced exploitation techniques and makes the vulnerability accessible to a broader range of threat actors.
Security mitigation for this vulnerability requires immediate deployment of the patched version 3.6.14, which incorporates the fix identified by the commit hash 0d3ab3c2d3f9f98abfafdf7b9f6d4f8ed3925e40. This patch addresses the authentication bypass by implementing proper credential verification mechanisms within the WebSocket endpoint handler. Organizations should also consider implementing additional monitoring for unusual WebSocket activity patterns and network traffic originating from the affected endpoint. The remediation process should include thorough testing to ensure that legitimate WebSocket connections continue to function properly while the authentication bypass is resolved. This vulnerability also highlights the importance of continuous security auditing of real-time communication endpoints, as they often receive less scrutiny than traditional API endpoints but pose significant security risks when improperly configured.