CVE-2026-5366Critical· 9.9▾ AbyssalPoC availablePrefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 54.5 · likelihood 0.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Nov 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.0%
1 GitHub repo (last check)
Prefect versions 3.1.11 through 3.6.24 are vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
prefect >= 3.1.11, < 3.6.25Upgrade to a patched release:
prefect 3.6.25Connected by shared product, vendor, weakness, or advisory.
CVE-2026-7725Medium· 6.3Prefect Git Argument Injection in GitRepository Pull Steps
CVE-2026-7724Medium· 5.0Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
CVE-2026-7723High· 7.3Prefect Unauthenticated Event Injection via /api/events/in WebSocket
CVE-2026-3515High· 8.5Prefect has an Argument Injection issue
CVE-2026-7722Medium· 5.3Prefect Auth Bypass via endswith() Health Check Exemption
CVE-2026-3514High· 7.5Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'