Vulnerability PYSEC-2026-2958
High Risk
HIGH RISK
CVSS Score: 7.3
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
3 months ago
July 13, 2026 at 03:02 PM UTC
Prefect Unauthenticated Event Injection via /api/events/in WebSocket
0.5.0 - 3.6.14.dev7
0.5.0 - 3.6.14.dev7
Summary
Prefect Unauthenticated Event Injection via /api/events/in WebSocket
Details
A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called 0d3ab3c2d3f9f98abfafdf7b9f6d4f8ed3925e40. It is recommended to upgrade the affected component.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
3 months ago
Prefect has an Argument Injection issue
0.5.0 - 3.6.18 PYSEC-2026-2957
0.5.0 - 3.6.18 PYSEC-2026-2957
Medium Risk
3 months ago
Prefect Git Argument Injection in GitRepository Pull Steps
0.5.0 - 3.6.25.dev6 PYSEC-2026-2955
0.5.0 - 3.6.25.dev6 PYSEC-2026-2955
Medium Risk
3 months ago
Prefect Auth Bypass via endswith() Health Check Exemption
0.5.0 - 3.6.22.dev8 PYSEC-2026-2956
0.5.0 - 3.6.22.dev8 PYSEC-2026-2956
Medium Risk
3 months ago
Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
0.5.0 - 3.6.28.dev1 PYSEC-2026-2959
0.5.0 - 3.6.28.dev1 PYSEC-2026-2959
High Risk
3 months ago
Prefect CORS (Cross-Origin Resource Sharing) misconfiguration
0.5.0 - 2.20.16 and 3.0.0rc1 - 3.0.2 PYSEC-2026-1800
0.5.0 - 2.20.16 and 3.0.0rc1 - 3.0.2 PYSEC-2026-1800
Impacted packages
Timeline
Published
3 months ago
July 13, 2026 at 03:02 PM UTC
Fixed (3.6.14)
9 months ago
January 29, 2026 at 09:26 PM UTC
Last Modified
3 months ago
July 13, 2026 at 04:32 PM UTC