What is the CVSS score of CVE-2026-3515?

CVE-2026-3515 has a CVSS 3.0 base score of 8.5 (High). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Prefect are affected by CVE-2026-3515?

CVE-2026-3515 affects Prefect 3.6.18's GitHub integration, allowing authenticated users with repository configuration access to inject arbitrary git commands that can lead to credential theft, SSRF…

How to fix or mitigate CVE-2026-3515?

Within 24 hours: Identify all Prefect deployments running version 3.6.18 and audit active GitHub integration configurations and user access levels. Within 7 days: Restrict authentication and authorization for Prefect GitHub integration block creation to only trusted administrators; rotate any GitHub credentials or tokens exposed through Prefect configurations. Within 30 days: Upgrade to Prefect version 3.7.0 or later once patched version is released by vendor, or implement air-gapping of Prefect instances that require GitHub integration until patch is available.

Prefect CVE-2026-3515

EUVD-2026-31563 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-05-24 @huntr_ai

GHSA-cw25-2p92-7f75

RCE SSRF Gitlab Prefecthq Prefect Prefecthq

8.5

CVSS 3.0 · Vendor: huntr_ai

Severity by source

Vendor (huntr_ai) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Primary rating from Vendor (huntr_ai) · only source for this CVE.

CVSS VectorVendor: huntr_ai

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 24, 2026 - 05:15 vuln.today

DescriptionCVE.org

A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper sanitization, and then parsed by shlex.split(). This enables injection of options such as -c, leading to potential Server-Side Request Forgery (SSRF), credential theft, or remote code execution (RCE). The vulnerability affects both the aget_directory() and get_directory() methods in src/integrations/prefect-github/prefect_github/repository.py. This issue does not affect the GitLab and BitBucket integrations, which use a safer list-based command construction approach.

AnalysisAI

Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands through the unsanitized reference field. The GitHubRepository block concatenates user input directly into git clone commands, enabling attackers to inject malicious options that can lead to SSRF, credential theft, or remote code execution. While no active exploitation is confirmed, the straightforward attack vector and high impact make this a priority for organizations using Prefect's GitHub integration features.

Technical ContextAI

The vulnerability exists in the prefect-github integration component of Prefect, an open-source workflow orchestration platform. The root cause is improper neutralization of special elements in command arguments (CWE-88), where the reference parameter in GitHubRepository blocks is concatenated into git command strings without validation. The code uses Python's shlex.split() to parse the command, but this occurs after the injection point, allowing attackers to inject git options like -c to execute arbitrary commands. The GitLab and BitBucket integrations are not affected as they use safer list-based command construction.

RemediationAI

No vendor-released patch identified at time of analysis. Until a patch is available, disable or restrict access to GitHubRepository blocks in Prefect deployments, particularly for untrusted users. If GitHub integration is required, implement input validation for the reference field at the application layer to reject special characters and command injection attempts. Consider migrating critical workflows to use GitLab or BitBucket integrations which are not affected by this vulnerability. Monitor git command execution logs for suspicious -c options or unexpected parameters. Apply principle of least privilege to Prefect service accounts to limit potential impact.