CVE-2026-3514

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-3514
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3514.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-3514
Aliases
Published
2026-06-02T07:28:33.260Z
Modified
2026-07-09T21:11:39.100927950Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Authentication Bypass in prefecthq/prefect
Details

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3514.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-863"
    ]
}
References

Affected packages

Git / github.com/prefecthq/prefect

Affected ranges

Type
GIT
Repo
https://github.com/prefecthq/prefect
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6ee9deda68331c17f8cf9dea437311f11639ef8f
Fixed
e21617125335025b4b27e7d6f0ca028e8e8f3b79
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:prefect:prefect:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.6.22"
        }
    ]
}

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.10.0
2.10.1
2.10.10
2.10.11
2.10.12
2.10.13
2.10.14
2.10.15
2.10.16
2.10.17
2.10.18
2.10.19
2.10.2
2.10.20
2.10.21
2.10.3
2.10.4
2.10.5
2.10.6
2.10.7
2.10.8
2.10.9
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.11.5
2.12.0
2.12.1
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.14.0
2.14.1
2.14.10
2.14.11
2.14.12
2.14.13
2.14.14
2.14.15
2.14.16
2.14.17
2.14.18
2.14.19
2.14.2
2.14.20
2.14.21
2.14.3
2.14.4
2.14.5
2.14.6
2.14.7
2.14.8
2.14.9
2.15.0
2.16.0
2.16.1
2.16.2
2.16.3
2.16.4
2.16.5
2.16.6
2.16.7
2.16.8
2.16.9
2.17.0
2.17.1
2.18.0
2.18.1
2.18.2
2.18.3
2.19.0
2.2.0
2.3.0
2.3.1
2.3.2
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.5.0
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.8
2.6.9
2.7.0
2.7.1
2.7.10
2.7.11
2.7.12
2.7.2
2.7.3
2.7.4
2.7.5
2.7.7
2.7.8
2.7.9
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.82
2.9.0
3.*
3.0.0
3.0.0rc1
3.0.0rc10
3.0.0rc11
3.0.0rc12
3.0.0rc13
3.0.0rc14
3.0.0rc15
3.0.0rc16
3.0.0rc17
3.0.0rc18
3.0.0rc19
3.0.0rc2
3.0.0rc20
3.0.0rc3
3.0.0rc4
3.0.0rc5
3.0.0rc6
3.0.0rc7
3.0.0rc8
3.0.0rc9
3.0.1
3.0.10
3.0.11
3.0.11.dev1
3.0.11.dev10
3.0.11.dev2
3.0.11.dev3
3.0.11.dev4
3.0.11.dev5
3.0.11.dev6
3.0.11.dev7
3.0.11.dev8
3.0.11.dev9
3.0.12.dev1
3.0.12.dev2
3.0.12.dev3
3.0.2
3.0.3
3.0.4
3.0.5
3.0.5.dev1
3.0.5.dev2
3.0.5.dev3
3.0.5.dev4
3.0.6
3.0.7
3.0.8
3.0.9
3.0.9.dev1
3.0.9.dev2
3.0.9.dev3
3.1.0
3.1.1
3.1.1.dev1
3.1.1.dev2
3.1.1.dev3
3.1.1.dev4
3.1.1.dev5
3.1.1.dev6
3.1.10
3.1.10.dev1
3.1.10.dev2
3.1.10.dev3
3.1.11
3.1.11.dev1
3.1.11.dev2
3.1.11.dev3
3.1.11.dev4
3.1.11.dev5
3.1.12
3.1.12.dev1
3.1.12.dev2
3.1.12.dev3
3.1.12.dev4
3.1.12.dev5
3.1.13
3.1.13.dev1
3.1.13.dev2
3.1.13.dev3
3.1.13.dev4
3.1.13.dev5
3.1.13.dev6
3.1.14
3.1.14.dev1
3.1.14.dev2
3.1.14.dev3
3.1.14.dev4
3.1.15
3.1.15.dev1
3.1.15.dev2
3.1.15.dev3
3.1.15.dev4
3.1.15.dev5
3.1.15.dev6
3.1.16.dev1
3.1.16.dev2
3.1.16.dev3
3.1.16.dev4
3.1.16.dev5
3.1.16.dev6
3.1.16.dev7
3.1.2
3.1.2.dev1
3.1.2.dev2
3.1.3
3.1.3.dev1
3.1.3.dev2
3.1.3.dev3
3.1.3.dev4
3.1.3.dev5
3.1.4
3.1.5
3.1.5.dev1
3.1.5.dev2
3.1.5.dev3
3.1.5.dev4
3.1.5.dev5
3.1.6
3.1.6.dev1
3.1.6.dev2
3.1.6.dev3
3.1.6.dev4
3.1.6.dev5
3.1.6.dev6
3.1.6.dev7
3.1.6.dev8
3.1.6.dev9
3.1.7
3.1.7.dev1
3.1.7.dev2
3.1.7.dev3
3.1.7.dev4
3.1.8
3.1.8.dev1
3.1.9
3.1.9.dev1
3.1.9.dev2
3.1.9.dev3
3.2.0
3.2.1
3.2.10
3.2.10.dev1
3.2.10.dev2
3.2.10.dev3
3.2.10.dev4
3.2.11
3.2.12
3.2.12.dev1
3.2.12.dev2
3.2.12.dev3
3.2.12.dev4
3.2.13
3.2.13.dev1
3.2.13.dev2
3.2.13.dev3
3.2.13.dev4
3.2.14
3.2.14.dev1
3.2.14.dev2
3.2.14.dev3
3.2.14.dev4
3.2.15
3.2.15.dev1
3.2.15.dev2
3.2.15.dev3
3.2.15.dev4
3.2.15.dev5
3.2.15.dev6
3.2.15.dev7
3.2.15.dev8
3.2.15.dev9
3.2.16.dev1
3.2.2
3.2.2.dev1
3.2.2.dev2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.2.7.dev1
3.2.8
3.2.8.dev1
3.2.8.dev2
3.2.8.dev3
3.2.8.dev4
3.2.9
3.3.0
3.3.1
3.3.2
3.3.2.dev1
3.3.2.dev2
3.3.3
3.3.3.dev1
3.3.4
3.3.4.dev1
3.3.4.dev2
3.3.4.dev3
3.3.5
3.3.5.dev1
3.3.5.dev2
3.3.5.dev3
3.3.5.dev4
3.3.6
3.3.6.dev1
3.3.6.dev2
3.3.6.dev3
3.3.6.dev4
3.3.7
3.3.7.dev1
3.3.8.dev1
3.3.8.dev2
3.3.8.dev3
3.3.8.dev4
3.4.0
3.4.1
3.4.1.dev1
3.4.1.dev2
3.4.1.dev3
3.4.1.dev4
3.4.1.dev5
3.4.10
3.4.10.dev1
3.4.11
3.4.11.dev1
3.4.11.dev2
3.4.11.dev3
3.4.11.dev4
3.4.11.dev5
3.4.12
3.4.12.dev1
3.4.12.dev2
3.4.12.dev3
3.4.12.dev4
3.4.13
3.4.13.dev1
3.4.13.dev2
3.4.13.dev3
3.4.14
3.4.14.dev1
3.4.14.dev2
3.4.14.dev3
3.4.14.dev4
3.4.15
3.4.15.dev1
3.4.15.dev2
3.4.15.dev3
3.4.15.dev4
3.4.16
3.4.16.dev1
3.4.16.dev2
3.4.16.dev3
3.4.16.dev4
3.4.16.dev5
3.4.16.dev6
3.4.17
3.4.18
3.4.18.dev1
3.4.18.dev2
3.4.18.dev3
3.4.18.dev4
3.4.18.dev5
3.4.19
3.4.19.dev1
3.4.19.dev2
3.4.19.dev3
3.4.19.dev4
3.4.19.dev5
3.4.2
3.4.2.dev1
3.4.2.dev2
3.4.2.dev3
3.4.2.dev4
3.4.2.dev5
3.4.20
3.4.20.dev1
3.4.20.dev2
3.4.21
3.4.21.dev1
3.4.21.dev2
3.4.21.dev3
3.4.21.dev4
3.4.21.dev5
3.4.22
3.4.23
3.4.23.dev1
3.4.23.dev2
3.4.23.dev3
3.4.24
3.4.24.dev1
3.4.24.dev2
3.4.24.dev3
3.4.24.dev4
3.4.24.dev5
3.4.25
3.4.25.dev1
3.4.25.dev2
3.4.25.dev3
3.4.25.dev4
3.4.25.dev5
3.4.26.dev1
3.4.26.dev2
3.4.26.dev3
3.4.26.dev4
3.4.26.dev5
3.4.26.dev6
3.4.3
3.4.3.dev1
3.4.3.dev2
3.4.4
3.4.4.dev1
3.4.4.dev2
3.4.5
3.4.5.dev1
3.4.5.dev2
3.4.5.dev3
3.4.5.dev4
3.4.5.dev5
3.4.6
3.4.6.dev1
3.4.6.dev2
3.4.7
3.4.7.dev1
3.4.7.dev2
3.4.7.dev3
3.4.7.dev4
3.4.7.dev5
3.4.7.dev6
3.4.7.dev7
3.4.7.dev8
3.4.7.dev9
3.4.8
3.4.8.dev1
3.4.8.dev2
3.4.8.dev3
3.4.8.dev4
3.4.8.dev5
3.4.8.dev6
3.4.8.dev7
3.4.8.dev8
3.4.9
3.4.9.dev1
3.4.9.dev2
3.4.9.dev3
3.4.9.dev4
3.4.9.dev5
3.5.0
3.5.1.dev1
3.5.1.dev2
3.5.1.dev3
3.5.1.dev4
3.6.0
3.6.1
3.6.1.dev1
3.6.10
3.6.10.dev1
3.6.10.dev2
3.6.10.dev3
3.6.10.dev4
3.6.10.dev5
3.6.11
3.6.11.dev1
3.6.11.dev2
3.6.11.dev3
3.6.11.dev4
3.6.11.dev5
3.6.12
3.6.12.dev1
3.6.12.dev2
3.6.12.dev3
3.6.12.dev4
3.6.12.dev5
3.6.13
3.6.13.dev1
3.6.13.dev2
3.6.14
3.6.14.dev1
3.6.14.dev2
3.6.14.dev3
3.6.14.dev4
3.6.14.dev5
3.6.14.dev6
3.6.14.dev7
3.6.15
3.6.16
3.6.16.dev1
3.6.16.dev2
3.6.16.dev3
3.6.16.dev4
3.6.16.dev5
3.6.16.dev6
3.6.16.dev7
3.6.17
3.6.17.dev1
3.6.17.dev2
3.6.17.dev3
3.6.17.dev4
3.6.17.dev5
3.6.17.dev6
3.6.18
3.6.18.dev1
3.6.18.dev2
3.6.18.dev3
3.6.18.dev4
3.6.18.dev5
3.6.18.dev6
3.6.19
3.6.19.dev1
3.6.19.dev2
3.6.19.dev3
3.6.2
3.6.2.dev1
3.6.20
3.6.20.dev1
3.6.20.dev2
3.6.20.dev3
3.6.20.dev4
3.6.20.dev5
3.6.21
3.6.21.dev1
3.6.21.dev2
3.6.21.dev3
3.6.21.dev4
3.6.21.dev5
3.6.22.dev1
3.6.22.dev2
3.6.22.dev3
3.6.22.dev4
3.6.22.dev5
3.6.22.dev6
3.6.22.dev7
3.6.22.dev8
3.6.3
3.6.3.dev1
3.6.3.dev2
3.6.3.dev3
3.6.4
3.6.4.dev1
3.6.5
3.6.5.dev1
3.6.5.dev2
3.6.5.dev3
3.6.5.dev4
3.6.5.dev5
3.6.5.dev6
3.6.5.dev7
3.6.6
3.6.6.dev1
3.6.6.dev2
3.6.6.dev3
3.6.6.dev4
3.6.6.dev5
3.6.7
3.6.7.dev1
3.6.7.dev2
3.6.7.dev3
3.6.7.dev4
3.6.7.dev5
3.6.7.dev6
3.6.7.dev7
3.6.7.dev8
3.6.7.dev9
3.6.8
3.6.8.dev1
3.6.8.dev2
3.6.8.dev3
3.6.9
3.6.9.dev1
prefect-aws-0.*
prefect-aws-0.4.15
prefect-aws-0.4.16
prefect-aws-0.5.0
prefect-aws-0.5.0rc1
prefect-aws-0.5.0rc2
prefect-aws-0.5.1
prefect-aws-0.5.10
prefect-aws-0.5.11
prefect-aws-0.5.12
prefect-aws-0.5.13
prefect-aws-0.5.14
prefect-aws-0.5.15
prefect-aws-0.5.16
prefect-aws-0.5.2
prefect-aws-0.5.3
prefect-aws-0.5.4
prefect-aws-0.5.5
prefect-aws-0.5.6
prefect-aws-0.5.7
prefect-aws-0.5.8
prefect-aws-0.5.9
prefect-aws-0.6.0
prefect-aws-0.7.0
prefect-aws-0.7.1
prefect-aws-0.7.2
prefect-aws-0.7.3
prefect-aws-0.7.4
prefect-aws-0.7.5
prefect-azure-0.*
prefect-azure-0.3.8
prefect-azure-0.3.9
prefect-azure-0.4.0
prefect-azure-0.4.0rc1
prefect-azure-0.4.0rc2
prefect-azure-0.4.1
prefect-azure-0.4.2
prefect-azure-0.4.3
prefect-azure-0.4.4
prefect-azure-0.4.5
prefect-azure-0.4.6
prefect-azure-0.4.7
prefect-azure-0.4.8
prefect-azure-0.4.9
prefect-bitbucket-0.*
prefect-bitbucket-0.2.3
prefect-bitbucket-0.2.4
prefect-bitbucket-0.3.0
prefect-bitbucket-0.3.0rc1
prefect-bitbucket-0.3.1
prefect-bitbucket-0.3.2
prefect-bitbucket-0.3.3
prefect-bitbucket-0.3.4
prefect-bitbucket-0.3.5
prefect-bitbucket-0.3.6
prefect-dask-0.*
prefect-dask-0.2.7
prefect-dask-0.2.8
prefect-dask-0.3.0
prefect-dask-0.3.0rc1
prefect-dask-0.3.0rc2
prefect-dask-0.3.1
prefect-dask-0.3.2
prefect-dask-0.3.3
prefect-dask-0.3.4
prefect-dask-0.3.5
prefect-dask-0.3.6
prefect-databricks-0.*
prefect-databricks-0.2.4
prefect-databricks-0.2.5
prefect-databricks-0.2.6
prefect-databricks-0.3.0
prefect-databricks-0.3.0rc1
prefect-databricks-0.3.0rc2
prefect-databricks-0.3.1
prefect-databricks-0.3.2
prefect-databricks-0.4.0
prefect-dbt-0.*
prefect-dbt-0.4.2
prefect-dbt-0.4.3
prefect-dbt-0.6.0
prefect-dbt-0.6.0rc1
prefect-dbt-0.6.0rc2
prefect-dbt-0.6.1
prefect-dbt-0.6.2
prefect-dbt-0.6.3
prefect-dbt-0.6.4
prefect-dbt-0.6.5
prefect-dbt-0.6.6
prefect-dbt-0.7.0
prefect-dbt-0.7.0rc1
prefect-dbt-0.7.1
prefect-dbt-0.7.10
prefect-dbt-0.7.11
prefect-dbt-0.7.12
prefect-dbt-0.7.13
prefect-dbt-0.7.14
prefect-dbt-0.7.15
prefect-dbt-0.7.16
prefect-dbt-0.7.17
prefect-dbt-0.7.18
prefect-dbt-0.7.19
prefect-dbt-0.7.2
prefect-dbt-0.7.20
prefect-dbt-0.7.3
prefect-dbt-0.7.4
prefect-dbt-0.7.5
prefect-dbt-0.7.6
prefect-dbt-0.7.7
prefect-dbt-0.7.8
prefect-dbt-0.7.9
prefect-docker-0.*
prefect-docker-0.5.0
prefect-docker-0.5.1
prefect-docker-0.6.0
prefect-docker-0.6.0rc1
prefect-docker-0.6.0rc2
prefect-docker-0.6.0rc3
prefect-docker-0.6.0rc4
prefect-docker-0.6.1
prefect-docker-0.6.2
prefect-docker-0.6.3
prefect-docker-0.6.4
prefect-docker-0.6.5
prefect-docker-0.6.6
prefect-docker-0.7.0
prefect-docker-0.7.1
prefect-email-0.*
prefect-email-0.3.3
prefect-email-0.3.4
prefect-email-0.4.0
prefect-email-0.4.0rc1
prefect-email-0.4.1
prefect-email-0.4.2
prefect-gcp-0.*
prefect-gcp-0.5.10
prefect-gcp-0.5.11
prefect-gcp-0.5.9
prefect-gcp-0.6.0
prefect-gcp-0.6.0rc1
prefect-gcp-0.6.0rc2
prefect-gcp-0.6.0rc3
prefect-gcp-0.6.1
prefect-gcp-0.6.10
prefect-gcp-0.6.11
prefect-gcp-0.6.12
prefect-gcp-0.6.13
prefect-gcp-0.6.14
prefect-gcp-0.6.15
prefect-gcp-0.6.16
prefect-gcp-0.6.17
prefect-gcp-0.6.2
prefect-gcp-0.6.3
prefect-gcp-0.6.4
prefect-gcp-0.6.5
prefect-gcp-0.6.6
prefect-gcp-0.6.7
prefect-gcp-0.6.8
prefect-gcp-0.6.9
prefect-github-0.*
prefect-github-0.2.3
prefect-github-0.2.4
prefect-github-0.3.0
prefect-github-0.3.0rc1
prefect-github-0.3.0rc2
prefect-github-0.3.1
prefect-github-0.3.2
prefect-github-0.4.0
prefect-github-0.4.1
prefect-github-0.4.2
prefect-gitlab-0.*
prefect-gitlab-0.2.3
prefect-gitlab-0.2.4
prefect-gitlab-0.3.0
prefect-gitlab-0.3.0rc1
prefect-gitlab-0.3.1
prefect-gitlab-0.3.2
prefect-gitlab-0.3.3
prefect-gitlab-0.3.4
prefect-kubernetes-0.*
prefect-kubernetes-0.3.8
prefect-kubernetes-0.3.9
prefect-kubernetes-0.4.0rc1
prefect-kubernetes-0.4.0rc2
prefect-kubernetes-0.4.0rc3
prefect-kubernetes-0.5.0
prefect-kubernetes-0.5.0rc1
prefect-kubernetes-0.5.0rc2
prefect-kubernetes-0.5.1
prefect-kubernetes-0.5.10
prefect-kubernetes-0.5.2
prefect-kubernetes-0.5.3
prefect-kubernetes-0.5.4
prefect-kubernetes-0.5.5
prefect-kubernetes-0.5.6
prefect-kubernetes-0.5.7
prefect-kubernetes-0.5.8
prefect-kubernetes-0.5.9
prefect-kubernetes-0.6.0
prefect-kubernetes-0.6.1
prefect-kubernetes-0.6.2
prefect-kubernetes-0.6.3
prefect-kubernetes-0.6.4
prefect-kubernetes-0.6.5
prefect-kubernetes-0.6.6
prefect-kubernetes-0.7.0
prefect-kubernetes-0.7.1
prefect-kubernetes-0.7.2
prefect-kubernetes-0.7.3
prefect-kubernetes-0.7.4
prefect-kubernetes-0.7.5
prefect-ray-0.*
prefect-ray-0.3.4
prefect-ray-0.3.5
prefect-ray-0.4.0
prefect-ray-0.4.0rc1
prefect-ray-0.4.0rc2
prefect-ray-0.4.1
prefect-ray-0.4.2
prefect-ray-0.4.3
prefect-ray-0.4.4
prefect-ray-0.4.5
prefect-redis-0.*
prefect-redis-0.2.0
prefect-redis-0.2.1
prefect-redis-0.2.2
prefect-redis-0.2.3
prefect-redis-0.2.4
prefect-redis-0.2.5
prefect-redis-0.2.6
prefect-redis-0.2.7
prefect-redis-0.2.8
prefect-shell-0.*
prefect-shell-0.2.3
prefect-shell-0.2.4
prefect-shell-0.3.0
prefect-shell-0.3.0rc1
prefect-shell-0.3.1
prefect-shell-0.3.2
prefect-shell-0.3.3
prefect-shell-0.3.4
prefect-shell-0.3.5
prefect-slack-0.*
prefect-slack-0.2.3
prefect-slack-0.2.4
prefect-slack-0.2.5
prefect-slack-0.3.0
prefect-slack-0.3.0rc1
prefect-slack-0.3.0rc2
prefect-slack-0.3.1
prefect-snowflake-0.*
prefect-snowflake-0.27.4
prefect-snowflake-0.27.5
prefect-snowflake-0.28.0
prefect-snowflake-0.28.0rc1
prefect-snowflake-0.28.1
prefect-snowflake-0.28.2
prefect-snowflake-0.28.3
prefect-snowflake-0.28.4
prefect-snowflake-0.28.5
prefect-snowflake-0.28.6
prefect-snowflake-0.28.7
prefect-sqlalchemy-0.*
prefect-sqlalchemy-0.4.1
prefect-sqlalchemy-0.4.2
prefect-sqlalchemy-0.5.0
prefect-sqlalchemy-0.5.0rc1
prefect-sqlalchemy-0.5.0rc2
prefect-sqlalchemy-0.5.1
prefect-sqlalchemy-0.5.2
prefect-sqlalchemy-0.5.3
prefect-sqlalchemy-0.6.0
prefect-sqlalchemy-0.6.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-3514.json"