PrefectHQ Prefect WebSocket Authentication Bypass Vulnerability

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 3.6.14 is able to address this issue. This patch is called f8afecadf88ea5f73694dafa3a365b9d8fae1ad6. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Casky was already ahead

This CVE exploits attack patterns that Casky's 261matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7723 represents a critical authentication bypass in PrefectHQ Prefect versions up to 3.6.13, affecting the WebSocket endpoint at /api/events/in. This vulnerability stems from missing authentication controls (CWE-287) and insufficient authentication checks (CWE-306), allowing unauthenticated attackers to manipulate WebSocket communications without proper credential validation. Organizations running Prefect workflow orchestration platforms are at risk, particularly those exposing the API endpoint to remote networks. The published exploit increases operational risk significantly, making immediate patching to version 3.6.14 essential for any environment handling sensitive workflow data or configurations.

Casky's 261 mapped skills detect this attack pattern by correlating behavior across MITRE ATT&CK's Initial Access (TA0004) and Execution (TA0006) phases. Practitioners using Casky would identify suspicious activity patterns including unauthenticated WebSocket connection attempts, unauthorized event injection into /api/events/in without valid tokens, and lateral movement from external network segments into orchestration systems. Claude's extended reasoning capabilities analyze authentication logs for missing credential validation checks, detect anomalous event streams bypassing normal access controls, and correlate remote connection patterns indicative of exploitation attempts. Security teams would see findings highlighting WebSocket connections lacking bearer tokens or session identifiers, repeated manipulation attempts on event handlers, and potential workflow hijacking indicators—enabling rapid response before attackers gain control of critical orchestration infrastructure.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

261 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7723.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-kubernetes-audit-logs

container security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-7723

Casky has 261 skills that investigate the attack patterns behind CVE-2026-7723. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn