CVE-2026-7723

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-7723
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7723.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-7723
Aliases
Downstream
Published
2026-05-04T02:30:18Z
Modified
2026-08-12T03:51:35Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
PrefectHQ prefect WebSocket Endpoint in missing authentication
Details

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-287",
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7723.json"
}
References

Affected packages

Git / github.com/prefecthq/prefect

Affected ranges

Type
GIT
Repo
https://github.com/prefecthq/prefect
Events
Introduced
cd8ff4ac08c0f703abdc3bed9fda4a1ea85bdefb
Fixed
f8afecadf88ea5f73694dafa3a365b9d8fae1ad6
Fixed
b0e01a685681be8c8dec056db0859a70bd25f0f8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "3.6.0"
        },
        {
            "last_affected": "3.6.0"
        },
        {
            "introduced": "3.6.1"
        },
        {
            "last_affected": "3.6.1"
        },
        {
            "introduced": "3.6.2"
        },
        {
            "last_affected": "3.6.2"
        },
        {
            "introduced": "3.6.3"
        },
        {
            "last_affected": "3.6.3"
        },
        {
            "introduced": "3.6.4"
        },
        {
            "last_affected": "3.6.4"
        },
        {
            "introduced": "3.6.5"
        },
        {
            "last_affected": "3.6.5"
        },
        {
            "introduced": "3.6.6"
        },
        {
            "last_affected": "3.6.6"
        },
        {
            "introduced": "3.6.7"
        },
        {
            "last_affected": "3.6.7"
        },
        {
            "introduced": "3.6.8"
        },
        {
            "last_affected": "3.6.8"
        },
        {
            "introduced": "3.6.9"
        },
        {
            "last_affected": "3.6.9"
        },
        {
            "introduced": "3.6.10"
        },
        {
            "last_affected": "3.6.10"
        },
        {
            "introduced": "3.6.11"
        },
        {
            "last_affected": "3.6.11"
        },
        {
            "introduced": "3.6.12"
        },
        {
            "last_affected": "3.6.12"
        },
        {
            "introduced": "3.6.13"
        },
        {
            "last_affected": "3.6.13"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.6.0
3.6.1
3.6.1.dev1
3.6.10
3.6.10.dev1
3.6.10.dev2
3.6.10.dev3
3.6.10.dev4
3.6.10.dev5
3.6.11
3.6.11.dev1
3.6.11.dev2
3.6.11.dev3
3.6.11.dev4
3.6.11.dev5
3.6.12
3.6.12.dev1
3.6.12.dev2
3.6.12.dev3
3.6.12.dev4
3.6.12.dev5
3.6.13
3.6.13.dev1
3.6.13.dev2
3.6.14.dev1
3.6.14.dev2
3.6.14.dev3
3.6.14.dev4
3.6.14.dev5
3.6.14.dev6
3.6.14.dev7
3.6.2
3.6.2.dev1
3.6.3
3.6.3.dev1
3.6.3.dev2
3.6.3.dev3
3.6.4
3.6.4.dev1
3.6.5
3.6.5.dev1
3.6.5.dev2
3.6.5.dev3
3.6.5.dev4
3.6.5.dev5
3.6.5.dev6
3.6.5.dev7
3.6.6
3.6.6.dev1
3.6.6.dev2
3.6.6.dev3
3.6.6.dev4
3.6.6.dev5
3.6.7
3.6.7.dev1
3.6.7.dev2
3.6.7.dev3
3.6.7.dev4
3.6.7.dev5
3.6.7.dev6
3.6.7.dev7
3.6.7.dev8
3.6.7.dev9
3.6.8
3.6.8.dev1
3.6.8.dev2
3.6.8.dev3
3.6.9
3.6.9.dev1
prefect-aws-0.*
prefect-aws-0.7.1
prefect-aws-0.7.2
prefect-aws-0.7.3
prefect-aws-0.7.4
prefect-azure-0.*
prefect-azure-0.4.7
prefect-azure-0.4.8
prefect-bitbucket-0.*
prefect-bitbucket-0.3.4
prefect-databricks-0.*
prefect-databricks-0.4.0
prefect-dbt-0.*
prefect-dbt-0.7.10
prefect-dbt-0.7.11
prefect-dbt-0.7.12
prefect-dbt-0.7.13
prefect-dbt-0.7.14
prefect-dbt-0.7.15
prefect-dbt-0.7.16
prefect-dbt-0.7.9
prefect-docker-0.*
prefect-docker-0.7.0
prefect-docker-0.7.1
prefect-gcp-0.*
prefect-gcp-0.6.12
prefect-gcp-0.6.13
prefect-gcp-0.6.14
prefect-gcp-0.6.15
prefect-github-0.*
prefect-github-0.4.0
prefect-kubernetes-0.*
prefect-kubernetes-0.7.1
prefect-kubernetes-0.7.2
prefect-kubernetes-0.7.3
prefect-redis-0.*
prefect-redis-0.2.7
prefect-redis-0.2.8
prefect-snowflake-0.*
prefect-snowflake-0.28.6
prefect-snowflake-0.28.7

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-7723.json"