PrefectHQ vulnerabilities

CVEs per yearBy the year they were published

1. 20231
2. 20251
3. 202610

Newest CVEs

• CVE-2026-120338

  Prefab UI Pyodide sandbox escape to host RCE

  PrefectHQ · prefab-ui

  Critical10.0
• CVE-2026-72538

  PrefectHQ Prefect - Argument Injection

  PrefectHQ · Prefect

  High8.8
• CVE-2026-5366

  Git Argument Injection in prefecthq/prefect

  prefecthq · prefecthq/prefect

  Critical9.9
• CVE-2026-3514

  Authentication Bypass in prefecthq/prefect

  prefecthq · prefecthq/prefect

  High7.5
• CVE-2026-3515

  Argument Injection in prefecthq/prefect

  prefecthq · prefecthq/prefect

  High8.5
• CVE-2026-7725

  PrefectHQ prefect GitRepository Pull storage.py argument injection

  PrefectHQ · prefect

  Medium5.3
• CVE-2026-7724

  PrefectHQ prefect Webhook/Notification validate_restricted_url toctou

  PrefectHQ · prefect

  Low2.3
• CVE-2026-7723

  PrefectHQ prefect WebSocket Endpoint in missing authentication

  PrefectHQ · prefect

  Medium6.9
• CVE-2026-7722

  PrefectHQ prefect Health Check API health endswith improper authentication

  PrefectHQ · prefect

  Medium6.9
• CVE-2026-32871

  FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability

  PrefectHQ · fastmcp

  Critical10.0