CVE-2026-3514: Authentication Bypass in prefecthq/prefect
In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allows an attacker to create resources with names ending in 'health' or 'ready' and access them without authentication. Affected endpoints include those for variables, flows, work pools, work queues, and deployments. This vulnerability can lead to unauthorized access to sensitive information, such as API keys and database credentials, stored in Prefect Variables.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
prefecthq/prefectto a version that resolves this vulnerability.Fixed in 3.6.19 - Configuration
Update Prefect authentication middleware so that only the intended health check probe endpoints are exempted from authentication, and remove the wildcard exemption for any URL path that merely ends with 'health' or 'ready'.
prefecthq/prefect authentication middleware URL path exemption handling for health checks = Do not exempt any URL path ending with 'health' or 'ready' from authentication checks; restrict exemptions strictly to the specific health check endpoints (as implemented by Prefect) - Operational
Review and rotate any exposed Prefect Variables secrets (e.g., API keys and database credentials) that may have been accessible due to the authentication bypass.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3514?
CVE-2026-3514 has a severity rating of 7.5, indicating a high security risk.
What type of vulnerability is CVE-2026-3514?
CVE-2026-3514 is an authentication bypass vulnerability affecting prefecthq/prefect.
How do I fix CVE-2026-3514?
To fix CVE-2026-3514, you should upgrade to a patched version of prefecthq/prefect that addresses the authentication bypass.
Which version of prefecthq/prefect is affected by CVE-2026-3514?
CVE-2026-3514 affects version 3.6.19 of prefecthq/prefect.
What are the potential risks of CVE-2026-3514?
CVE-2026-3514 can allow unauthorized access to sensitive health check information due to improper authentication.