prefect has 8 CVEs on record between 2023 and 2026. Disclosures have slowed: 0 in the last 90 days after 6 in the 90 before. The busiest recent month was May 2026 with 5. The median CVSS is 7.4 (high). None have a confirmed exploitation report.

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 7.4
Publish → KEV: —
Last 90 days: 0 prev 6

Products

prefect 8

Follow prefect:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

prefect vulnerabilities

CVEs affecting prefect, newest first. Open any entry for full detail, references, and exploit status.

8 CVEsRSS

CVE-2026-3514High· 7.5

4mo ago

Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

▾ Twilightprefect · prefectEPSS 0.48%via OSV

CVE-2026-3515High· 8.5

5mo ago

CVEs per month

Products

Worst active — by depth score

prefect vulnerabilities

Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'

Prefect has an Argument Injection issue

Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url

Prefect Unauthenticated Event Injection via /api/events/in WebSocket

Prefect Auth Bypass via endswith() Health Check Exemption

Prefect Git Argument Injection in GitRepository Pull Steps

Prefect CORS (Cross-Origin Resource Sharing) misconfiguration

Cross-Site Request Forgery vulnerability in Prefect