CVE-2026-7724

描述

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validate_restricted_url of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 3.6.28.dev2 addresses this issue. The identifier of the patch is 7c70ac54a5e101431d83b9f2681ec88d5e0021ed. Upgrading the affected component is advised.

如何修補 CVE-2026-7724

要修補 CVE-2026-7724,請將受影響套件升級到下列已修補版本。

• —升級至 3.6.28.dev2 或更新版本
• —升級至 3.6.28.dev2 或更新版本

CVE-2026-7724 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.6.28.dev2
• from 0, < 3.6.28.dev2

CVSS 分數

參考連結(12)

• ADVISORYgithub.com/advisories/GHSA-p3pq-hxmr-vqqr
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-7724
• PATCHgithub.com/PrefectHQ/prefect
• PATCHpypi.org/project/prefect
• WEBgist.github.com/nedlir/fa99777e8989414585d08c3625bf044a