In Prefect 3.6.19 the authentication middleware incorrectly exempts any URL path that ends with the strings "health" or "ready" from authentication checks. This flaw allows an attacker to create a resource whose name ends with those strings and then access that resource without needing to authenticate. The breach enables disclosure of confidential information, such as API keys and database credentials, that are stored in Prefect Variables. The weakness is classified as CWE-863, an authorization bypass through user-controlled keys.

The vulnerability affects the Prefect Prefect product, version 3.6.19. Endpoints impacted include those that create or manage variables, flows, work pools, work queues, and deployments. No other product versions or vendors are currently known to be affected.

The CVSS score of 7.5 indicates a high severity vulnerability. The EPSS score is not available, and the issue is not yet listed in the CISA KEV catalog, but the lack of authentication enforcement presents a clear attack path. An attacker with network access to the Prefect API can create resources with names ending in "health" or "ready" and subsequently retrieve those resources without authentication, directly exposing sensitive configuration data. The potential for exploitation is significant given the simplicity of crafting such requests and the critical nature of the data that can be accessed.