CVE-2026-7723 PrefectHQ prefect WebSocket Endpoint in missing authentication
Remote attackers can access the WebSocket endpoint without authentication, bypassing security controls in the Prefect workflow library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-7723?
CVE-2026-7723 is a medium-severity missing authorization vulnerability in PrefectHQ prefect, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Which versions are affected by CVE-2026-7723?
3 open source packages ship an affected version, including prefect.
| Package | Affected | Fixed in |
|---|---|---|
prefect PyPI | All versions | 3.6.14 |
prefect PyPI | All versions | 3.6.14 |
prefect PyPI | All versions | 3.6.14 |
How do I fix CVE-2026-7723?
Upgrade prefect to 3.6.14 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-7723 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-7723 exists.
Sources
Also known as GHSA-hvph-5985-r63v, PYSEC-2026-2958, ROOT-APP-PYPI-CVE-2026-7723.