An authentication bypass vulnerability (CWE-863) exists in prefecthq/prefect version 3.6.19 due to improper handling of URL path exemptions for health check probes. The authentication middleware allows any URL path ending with 'health' or 'ready' to bypass authentication. Attackers can exploit this by naming resources with these suffixes to gain unauthorized access to sensitive endpoints, including variables, flows, work pools, work queues, and deployments. This can lead to exposure of sensitive information like API keys and database credentials. The CVSS v3.0 score is 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No patch or official remediation is currently documented.

Exploitation of this vulnerability allows unauthenticated attackers to bypass authentication controls on specific endpoints by leveraging URL path exemptions. This can lead to unauthorized access to sensitive information such as API keys and database credentials associated with variables, flows, work pools, work queues, and deployments. The confidentiality impact is high, but integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints through network-level controls or reverse proxies that enforce authentication regardless of URL path suffixes. Avoid naming resources with 'health' or 'ready' suffixes to reduce exposure. Monitor vendor channels for updates and apply official patches once released.