{"action":"Upgrade prefect to 3.6.22 or later.","affected":[{"fixed":"3.6.22","introduced":"0"}],"component":"prefect","cve_ids":["CVE-2026-7722"],"ecosystem":"PyPI","epss":0.00453,"exploited":false,"fixed_versions":["3.6.22"],"ghsa_id":"GHSA-6rr6-v7cj-mxpg","id":"tcs_01M5KH2JT37D1MXPJHKWBHM099","modified_at":"2026-07-13T16:32:07.226178048Z","published_at":"2026-07-13T15:02:56.708327Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2956","https://nvd.nist.gov/vuln/detail/CVE-2026-7722","https://github.com/PrefectHQ/prefect/pull/21063","https://github.com/PrefectHQ/prefect/pull/21063/changes/d8c4ff97ef7c0a940925d32b2d76324c8def42de","https://github.com/PrefectHQ/prefect/commit/e21617125335025b4b27e7d6f0ca028e8e8f3b79","https://gist.github.com/nedlir/f576abbb0e491dc9bb7e106c140dda04","https://github.com/PrefectHQ/prefect","https://github.com/PrefectHQ/prefect/releases/tag/3.6.22","https://vuldb.com/submit/807255","https://vuldb.com/vuln/360898","https://vuldb.com/vuln/360898/cti","https://pypi.org/project/prefect","https://github.com/advisories/GHSA-6rr6-v7cj-mxpg"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2026-2956","url":"https://osv.dev/vulnerability/PYSEC-2026-2956"}],"summary":"Prefect Auth Bypass via endswith() Health Check Exemption"}