PrefectHQ Prefect CVE-2026-72538

Exploitation requires a valid authenticated session with at least low-privilege access to the Prefect instance - specifically, the ability to create or modify a flow deployment that uses the git_clone pull step and control the branch field within it. The vulnerability is triggered at deployment pull time (when Prefect invokes git pull on the server), not simply upon saving the configuration. Unauthenticated attackers cannot exploit this vulnerability (PR:L per CVSS). Prefect deployments where all users with deployment-authoring rights are fully trusted represent reduced practical risk. Instances where the git_clone pull step is not used in any active deployment are not directly exploitable via this specific vector. The attack executes with the OS-level permissions of the Prefect server process, which limits further privilege escalation unless that process runs with elevated system privileges.

The CVSS 8.8 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is consistent with the described vulnerability: network-reachable, low complexity, requiring only a low-privilege authenticated session, with full confidentiality, integrity, and availability impact on the Prefect server. EPSS score is not available in the provided intelligence data, so exploitation probability cannot be quantified numerically. No CISA KEV listing is present, and no public exploit code has been identified at time of analysis. However, the prior incomplete fix for CVE-2026-5366 strongly implies that security researchers have already analyzed this code path, materially lowering the bar for exploit development; the argument injection technique is well-understood and does not require novel research. Even a mid-sized municipal IT team in koszalin operating Prefect for internal data pipeline automation should treat this as urgent, since any user with deployment authoring rights - not only administrators - can trigger server-side code execution. The unchanged scope (S:U) means lateral movement beyond the Prefect server process is not inherent to the vulnerability itself, but the Prefect server process typically holds significant credentials, secrets, and network access, making server compromise a severe outcome in most deployment architectures.

An authenticated Prefect user with deployment authoring rights submits a flow deployment configuration in which the git_clone pull step branch field contains a crafted value such as main --upload-pack=/bin/bash, injecting an additional git argument. When Prefect executes the deployment pull operation and invokes git pull on the server, the injected flag causes git to execute the attacker-specified binary with the permissions of the Prefect service account, yielding remote code execution. No public proof-of-concept has been identified at time of analysis, but the technique mirrors the prior CVE-2026-5366 bypass, making exploit construction straightforward for researchers already familiar with that issue.