CVE-2026-3514: Prefect Authentication Bypass Vulnerability

CVE-2026-3514 Overview

CVE-2026-3514 is an authentication bypass vulnerability in prefecthq/prefect version 3.6.19. The authentication middleware exempts any URL path ending with health or ready from authentication checks. Attackers can create Prefect resources with names ending in health or ready and access them unauthenticated. Affected endpoints include variables, flows, work pools, work queues, and deployments. The flaw enables unauthorized read access to sensitive data stored in Prefect Variables, including API keys and database credentials. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact
Unauthenticated remote attackers can retrieve secrets such as API keys and database credentials stored in Prefect Variables by abusing the health probe path exemption.

Affected Products

Prefect (prefecthq/prefect) version 3.6.19
Self-hosted Prefect server deployments using the affected middleware
Prefect API endpoints for variables, flows, work pools, work queues, and deployments

Discovery Timeline

2026-06-02 - CVE-2026-3514 published to NVD
2026-06-03 - Last updated in NVD database
Vendor fix - Commit e21617125335025b4b27e7d6f0ca028e8e8f3b79 published to the Prefect repository
Disclosure - Reported via the Huntr Security Bounty program

Technical Details for CVE-2026-3514

Vulnerability Analysis

Prefect's authentication middleware performs a path-suffix check to exempt Kubernetes-style liveness and readiness probes from authentication. The middleware treats any request whose URL path ends with the strings health or ready as a probe and skips authorization. Because Prefect resources such as Variables, Flows, and Deployments accept user-supplied names, an attacker can create a resource whose name terminates in health or ready. Subsequent requests to that resource URL match the exemption and bypass authentication entirely.

The impact concentrates on Prefect Variables, which administrators frequently use to store secrets such as API tokens, database credentials, and integration keys. An unauthenticated attacker with network reach to the Prefect API can enumerate these secrets and pivot to downstream systems. The vulnerability is exploitable over the network with no privileges or user interaction.

Root Cause

The root cause is a substring-based authorization decision in the middleware [CWE-863]. The exemption logic uses a suffix match on the request path rather than matching the canonical, server-owned probe routes (for example, exact paths like /health and /ready). Any tenant-controlled identifier appearing in the URL can therefore satisfy the exemption.

Attack Vector

An attacker with valid credentials, or one who obtains a single resource-creation token, names a Prefect Variable with a suffix of health or ready. In multi-tenant or misconfigured environments, an unauthenticated attacker may also reach existing resources whose names happen to end in these suffixes. The attacker then issues HTTP GET requests directly to the API endpoint for that resource and receives the resource value without presenting credentials. The vendor patch in commit e21617125335025b4b27e7d6f0ca028e8e8f3b79 replaces the suffix check with exact path matching against the server's probe routes.

Detection Methods for CVE-2026-3514

Indicators of Compromise

Prefect Variable, Flow, Deployment, Work Pool, or Work Queue names with suffixes health or ready that do not match an internal naming convention.
Successful HTTP 200 responses to /api/variables/name/*health or /api/variables/name/*ready requests originating from clients without an Authorization header or API key.
Spikes in unauthenticated requests to API paths that resolve to resource objects rather than the canonical probe endpoints.

Detection Strategies

Audit the Prefect API access logs for requests to resource endpoints terminating in health or ready that lack authentication headers.
Inventory all Prefect resources and flag any with names ending in health or ready for review and renaming.
Compare deployed Prefect versions against 3.6.19 and the patched release to identify exposed instances.

Monitoring Recommendations

Forward Prefect server logs and reverse-proxy access logs to a centralized analytics platform and alert on unauthenticated 2xx responses to non-probe paths.
Monitor outbound network activity from systems that consume Prefect Variable secrets for unexpected destinations that may indicate credential reuse.
Track resource creation events in Prefect and alert when new resources are created with suspicious suffix patterns.

How to Mitigate CVE-2026-3514

Immediate Actions Required

Upgrade Prefect to a version that includes commit e21617125335025b4b27e7d6f0ca028e8e8f3b79.
Rotate every secret, API key, and credential stored in Prefect Variables, treating them as potentially exposed.
Restrict network access to the Prefect API so only trusted clients and orchestrator components can reach it.
Rename any existing Prefect resources whose names end in health or ready.

Patch Information

The vendor fix is published in the Prefect repository at commit e21617125335025b4b27e7d6f0ca028e8e8f3b79. The patch updates the authentication middleware to match exact probe paths rather than performing a suffix comparison. Additional context is available in the Huntr Security Bounty report.

Workarounds

Place the Prefect API behind a reverse proxy or API gateway that enforces authentication for all paths except a hard-coded allowlist of /health and /ready.
Block external traffic to resource endpoints matching the pattern *health or *ready at the network layer until patching is complete.
Disallow user-supplied resource names ending in health or ready through pre-creation validation in deployment pipelines.

bash

# Example NGINX snippet restricting probe paths to exact matches
location = /health { proxy_pass http://prefect_upstream; }
location = /ready  { proxy_pass http://prefect_upstream; }
location / {
    auth_request /_auth;
    proxy_pass http://prefect_upstream;
}