CVE-2026-7723: PrefectHQ Auth Bypass Vulnerability

CVE-2026-7723 Overview

CVE-2026-7723 is a missing authentication vulnerability [CWE-287] in PrefectHQ Prefect versions up to 3.6.13. The flaw resides in the /api/events/in WebSocket endpoint, which accepts incoming event streams without verifying the caller's identity. Remote attackers can connect to the endpoint over the network and publish arbitrary events into the Prefect event bus. The vendor patched the issue in version 3.6.14 via commit f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. A public exploit reference has been published.

Critical Impact
Unauthenticated remote attackers can inject events into the Prefect server's WebSocket event ingestion endpoint, affecting confidentiality, integrity, and availability of orchestrated workflow telemetry.

Affected Products

PrefectHQ Prefect versions up to and including 3.6.13
Prefect server deployments exposing the /api/events/in WebSocket endpoint
Self-hosted Prefect installations reachable over the network

Discovery Timeline

2026-05-04 - CVE-2026-7723 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7723

Vulnerability Analysis

Prefect is a workflow orchestration platform whose server component exposes a FastAPI-based events router. The /api/events/in WebSocket endpoint accepts streamed events from clients and forwards them to the internal event publisher. In versions up to 3.6.13, the endpoint calls websocket.accept() directly without invoking any authentication helper. Any network-reachable client can therefore open a WebSocket session and publish events.

The missing authentication maps to [CWE-287]. Attackers can leverage the endpoint to inject forged events, pollute audit and telemetry data, trigger downstream automations bound to event patterns, or exhaust server resources by streaming high event volumes.

Root Cause

The root cause is the absence of an authentication check in the stream_events_in handler in src/prefect/server/api/events.py. Other Prefect WebSocket endpoints use a subscriptions.accept_prefect_socket helper that validates the configured PREFECT_API_AUTH_STRING or API key before accepting the socket. The events ingestion handler skipped this step.

Attack Vector

Exploitation requires only network access to the Prefect server's HTTP interface. No credentials, user interaction, or privileges are needed. An attacker connects to the WebSocket endpoint and begins sending serialized Event payloads, which the publisher accepts and forwards to subscribers.

python

# Patch in src/prefect/server/api/events.py - adds authentication
@router.websocket("/in")
async def stream_events_in(websocket: WebSocket) -> None:
    """Open a WebSocket to stream incoming Events"""
    websocket = await subscriptions.accept_prefect_socket(websocket)
    if not websocket:
        return

    try:
        async with messaging.create_event_publisher() as publisher:
            ...

Source: GitHub Prefect Commit f8afecad

Detection Methods for CVE-2026-7723

Indicators of Compromise

WebSocket upgrade requests to /api/events/in from unexpected source IPs or user agents
Spikes in inbound event volume on the Prefect event publisher without correlated worker activity
Anomalous or malformed Event records in the Prefect event store lacking matching flow runs
Connections to the Prefect API port from networks outside the orchestration trust boundary

Detection Strategies

Inspect Prefect server access logs for GET /api/events/in requests with Upgrade: websocket headers and correlate with authenticated client inventory
Compare published event sources against the set of legitimate Prefect workers and agents to identify forged producers
Alert on Prefect server processes accepting WebSocket connections from non-allowlisted CIDR ranges

Monitoring Recommendations

Forward Prefect API and reverse proxy logs to a centralized logging or SIEM platform for retention and correlation
Track event ingestion rate baselines and alert on deviations consistent with injection or flooding
Audit network policies to confirm the Prefect API port is not exposed beyond intended consumers

How to Mitigate CVE-2026-7723

Immediate Actions Required

Upgrade Prefect server to version 3.6.14 or later, which includes commit f8afecadf88ea5f73694dafa3a365b9d8fae1ad6
Restrict network exposure of the Prefect API so only trusted workers and clients can reach /api/events/in
Configure PREFECT_API_AUTH_STRING or API key authentication on all Prefect server deployments
Review event store contents for forged or unexpected events created prior to patching

Patch Information

The fix is delivered in Prefect 3.6.14 through pull request #20372. The patch routes the /api/events/in handler through subscriptions.accept_prefect_socket, which enforces authentication before the WebSocket is accepted. See the upstream commit for the full diff and the VulDB entry #360899 for additional metadata.

Workarounds

Place the Prefect server behind an authenticating reverse proxy that requires credentials for WebSocket upgrade requests to /api/events/in
Apply firewall or network policy rules limiting access to the Prefect API to known worker subnets
Disable external exposure of the Prefect server until the upgrade to 3.6.14 can be deployed

bash

# Upgrade Prefect to the patched release
pip install --upgrade "prefect>=3.6.14"

# Verify the installed version
prefect version

# Enforce API authentication on the server
export PREFECT_API_AUTH_STRING="<strong-shared-secret>"