CVE-2026-7724: PrefectHQ Race Condition Vulnerability

CVE-2026-7724 Overview

CVE-2026-7724 is a Time-of-Check Time-of-Use (TOCTOU) race condition [CWE-362] in PrefectHQ Prefect versions up to 3.6.28.dev1. The flaw resides in the validate_restricted_url function used by the Webhook and Notification components. An attacker with low privileges can leverage DNS rebinding to bypass the URL allowlist check, causing Prefect to connect to a different IP address than the one validated. The issue is remotely reachable but carries high attack complexity, and exploitation is considered difficult. Prefect addressed the issue in version 3.6.28.dev2 via commit 7c70ac54a5e101431d83b9f2681ec88d5e0021ed.

Critical Impact
Successful exploitation enables Server-Side Request Forgery (SSRF) against internal network resources by defeating Prefect's URL restriction logic through DNS rebinding.

Affected Products

PrefectHQ Prefect versions up to and including 3.6.28.dev1
Prefect Webhook block (src/prefect/blocks/webhook.py)
Prefect Notification block (src/prefect/blocks/notifications.py)

Discovery Timeline

2026-05-04 - CVE-2026-7724 published to NVD
2026-05-04 - Last updated in NVD database

Technical Details for CVE-2026-7724

Vulnerability Analysis

The vulnerability is a TOCTOU race condition in Prefect's validate_restricted_url utility. Prefect uses this function to ensure outbound HTTP requests from Webhook and Notification blocks do not target restricted internal addresses. The function resolves a hostname, validates the resulting IP, and then allows the HTTP client to perform a fresh DNS resolution when establishing the connection. This two-step pattern creates an exploitable window between validation and use.

An attacker who controls an authoritative DNS server can return a public IP for the validation lookup and an internal IP for the subsequent connection. The HTTP transport then connects to an internal resource the policy intended to block.

Root Cause

The root cause is the separation between IP validation and IP usage. validate_restricted_url resolved the hostname once for inspection, but the httpx transport executed a second, independent resolution at connection time. Because DNS responses can change between the two lookups (DNS rebinding), the validated IP is not guaranteed to be the IP the client connects to. The control therefore fails to bind the resolution result to the actual network connection.

Attack Vector

Exploitation requires an authenticated low-privileged user able to configure a Webhook or Notification block with an attacker-controlled URL. The attacker hosts a domain whose DNS responses alternate between a benign external IP and an internal target such as 127.0.0.1 or cloud metadata endpoints like 169.254.169.254. When Prefect validates the URL, the benign IP is returned. When the request is dispatched, the rebound internal IP is used, achieving SSRF.

The patch introduces SSRFProtectedHTTPTransport and SSRFProtectedAsyncHTTPTransport classes that pre-resolve the hostname, validate the IP, and connect directly to that pre-resolved address — closing the TOCTOU window.

python

# Patch excerpt: src/prefect/blocks/webhook.py
from prefect.blocks.core import Block
from prefect.types import SecretDict
-from prefect.utilities.urls import validate_restricted_url
+from prefect.utilities.urls import (
+    SSRFProtectedAsyncHTTPTransport,
+    validate_restricted_url,
+)

# Use a global HTTP transport to maintain a process-wide connection pool for
# interservice requests
_http_transport = AsyncHTTPTransport()
_insecure_http_transport = AsyncHTTPTransport(verify=False)
+# Separate pools for calls that must be protected from DNS-rebinding SSRF.  The
+# protected transport validates the resolved IP at connection time and connects
+# to the pre-resolved address, closing the TOCTOU window exploited by DNS
+# rebinding attacks.
+_safe_http_transport = SSRFProtectedAsyncHTTPTransport()
+_safe_insecure_http_transport = SSRFProtectedAsyncHTTPTransport(verify=False)

Source: Prefect Commit 7c70ac5

Detection Methods for CVE-2026-7724

Indicators of Compromise

Webhook or Notification block configurations referencing externally hosted domains with unusually low DNS TTL values (often under 5 seconds).
Outbound HTTP connections from Prefect workers to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local 169.254.169.254 originating from Webhook/Notification calls.
DNS query patterns showing the same hostname resolving to different IPs within seconds from the Prefect host.

Detection Strategies

Monitor Prefect server and worker logs for Webhook/Notification dispatch events and correlate them with subsequent network egress to internal IPs.
Inspect DNS resolver telemetry for hostnames that return mixed public and private IPs across consecutive lookups.
Audit installed Prefect versions across the environment and flag any instance at or below 3.6.28.dev1.

Monitoring Recommendations

Forward DNS, HTTP egress, and Prefect application logs into a centralized analytics pipeline for correlation.
Alert on outbound connections from Prefect processes to cloud metadata endpoints or loopback addresses.
Track creation and modification of Webhook and Notification blocks, especially by low-privilege accounts.

How to Mitigate CVE-2026-7724

Immediate Actions Required

Upgrade Prefect to version 3.6.28.dev2 or later, which introduces SSRFProtectedAsyncHTTPTransport and SSRFProtectedHTTPTransport.
Inventory all Webhook and Notification blocks and review their target URLs for unexpected external domains.
Restrict who can create or edit Webhook and Notification blocks to trusted operators only.

Patch Information

The fix is delivered in Prefect 3.6.28.dev2 via commit 7c70ac54a5e101431d83b9f2681ec88d5e0021ed and pull request #21591. The patch replaces direct AsyncHTTPTransport usage with SSRF-protected transports that pre-resolve the hostname, validate the IP, and connect to that exact address — eliminating the DNS rebinding window. See the Prefect Release Notes for 3.6.28.dev2 and the Prefect Pull Request #21591.

Workarounds

Place Prefect workers behind an egress proxy that blocks connections to RFC1918, loopback, and link-local ranges.
Apply network policies to deny Prefect pods or hosts access to cloud metadata endpoints such as 169.254.169.254.
Restrict Webhook and Notification URLs to a vetted allowlist of fully qualified domain names enforced at the network layer.

bash

# Example: upgrade Prefect to the patched version
pip install --upgrade "prefect>=3.6.28.dev2"

# Verify the installed version
prefect version