---
id: CVE-2026-7722
aliases:
  - GHSA-6rr6-v7cj-mxpg
  - PYSEC-2026-2956
title: Prefect Auth Bypass via endswith() Health Check Exemption
summary: Prefect Auth Bypass via endswith() Health Check Exemption
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'
vendor: prefect
product: prefect
ecosystem: pip
affected:
  - prefect < 3.6.22
patched:
  - prefect 3.6.22
published: '2026-05-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:45.876309429Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-6rr6-v7cj-mxpg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-7722'
  - url: 'https://github.com/PrefectHQ/prefect/pull/21063'
  - url: >-
      https://github.com/PrefectHQ/prefect/pull/21063/changes/d8c4ff97ef7c0a940925d32b2d76324c8def42de
  - url: >-
      https://github.com/PrefectHQ/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79
  - url: 'https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04'
  - url: 'https://github.com/PrefectHQ/prefect'
  - url: 'https://github.com/PrefectHQ/prefect/releases/tag/3.6.22'
  - url: 'https://vuldb.com/submit/807255'
  - url: 'https://vuldb.com/vuln/360898'
  - url: 'https://vuldb.com/vuln/360898/cti'
tags:
  - osv
  - pip
epss: 0.00453
epssPercentile: 0.38712
ingestedAt: '2026-07-13T18:57:54.022Z'
---

## Overview

A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 3.6.22 will fix this issue. Upgrading the affected component is recommended.

## Affected packages

- `prefect < 3.6.22`

## Remediation

Upgrade to a patched release:

- `prefect 3.6.22`