In prefecthq/prefect version 3.6.19, an incorrect authorization vulnerability (CWE-863) exists due to improper handling of URL path exemptions in the authentication middleware. Paths ending with 'health' or 'ready' are excluded from authentication, allowing attackers to bypass authentication by naming resources with these suffixes. This affects multiple endpoints including variables, flows, work pools, work queues, and deployments, potentially exposing sensitive data such as API keys and database credentials stored in Prefect Variables. The vulnerability is rated high severity with a CVSS 3.0 score of 7.5. No patch or official remediation level has been disclosed as of the published date.

The vulnerability allows unauthenticated attackers to access sensitive endpoints by exploiting the authentication bypass for URL paths ending with 'health' or 'ready'. This can lead to unauthorized disclosure of sensitive information, including API keys and database credentials stored within Prefect Variables. There is no indication of impact on integrity or availability, and no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid naming resources with suffixes 'health' or 'ready' and restrict access to Prefect endpoints through network controls or other compensating controls to reduce exposure.