Executive Summary

CVE-2026-7722 is an authentication bypass vulnerability in PrefectHQ prefect versions up to 3.6.21. It affects the Health Check API, specifically the function endswith in the /api/health endpoint. Due to an overly permissive exemption in the authentication middleware for the health check path, an attacker can remotely manipulate requests to bypass authentication.

This flaw allows unauthorized users to access parts of the system without proper authentication.

The issue was fixed by tightening the health check path exemption in the authentication middleware, and the fix was merged on March 10, 2026.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to bypass authentication on the Health Check API endpoint, potentially granting unauthorized access to system health information or other sensitive data exposed via this endpoint.

Such unauthorized access could be leveraged to gain insights into system status or to facilitate further attacks.

Upgrading to Prefect version 3.6.22 is recommended to mitigate this risk.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves an authentication bypass in the Health Check API's /api/health endpoint due to an overly permissive path exemption. Detection would involve monitoring or testing access to this endpoint without proper authentication.

You can attempt to detect the vulnerability by sending unauthenticated requests to the /api/health endpoint and observing if access is granted improperly.

• Use curl to test access: curl -i http://<target-host>/api/health
• Check logs for unauthorized access attempts to /api/health.
• Use network monitoring tools to detect unusual or unauthorized traffic to the /api/health endpoint.

Useful 0 Not Useful 0

Mitigation Strategies

The recommended immediate mitigation is to upgrade PrefectHQ prefect to version 3.6.22 or later, as this version contains the fix for the authentication bypass vulnerability.

Until the upgrade can be applied, restrict access to the /api/health endpoint to trusted networks or authenticated users only, to prevent remote exploitation.

Review and tighten authentication middleware rules to ensure the health check path exemption is not overly permissive.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify how the vulnerability CVE-2026-7722 affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0