PT-2026-36754 · Prefecthq · Prefect

Nedlir · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7724

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PrefectHQ prefect versions prior to 3.6.28.dev2

Description A time-of-check time-of-use (TOCTOU) issue exists in the validate restricted url() function of the Webhook/Notification component. This flaw allows a remote attacker to manipulate the system, although the attack is characterized by high complexity and is difficult to exploit.

Recommendations Update to version 3.6.28.dev2.

Exploit

Fix

Time Of Check To Time Of Use

Race Condition

Weakness Enumeration

CWE-367

CWE-362

Related Identifiers

CVE-2026-7724

Affected Products

Prefect

References · 11

• 🔥 https://gist.github.com/nedlir/fa99777e8989414585d08c3625bf044a · Exploit
• https://github.com/PrefectHQ/prefect/releases/tag/3.6.28.dev2 · Patch
• https://github.com/PrefectHQ/prefect/pull/21591 · Patch
• https://github.com/PrefectHQ/prefect/commit/7c70ac54a5e101431d83b9f2681ec88d5e0021ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7724 · Security Note
• https://linear.app/prefect/issue/OSS-7874/fix-dns-rebinding-toctou-bypass-in-validate-restricted-url · Note
• https://vuldb.com/vuln/360900/cti · Note
• https://twitter.com/VulmonFeeds/status/2051152755444642154 · Twitter Post
• https://github.com/PrefectHQ/prefect · Note
• https://vuldb.com/submit/807303 · Note
• https://vuldb.com/vuln/360900 · Note