What is the CVSS score of CVE-2026-72538?

CVE-2026-72538 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of PrefectHQ Prefect are affected by CVE-2026-72538?

Prefect versions through 3.8.2 contain a remote code execution vulnerability in the git_clone pull step that allows authenticated users to inject arbitrary commands, bypassing a previous…

How to fix or mitigate CVE-2026-72538?

Within 24 hours, audit all Prefect deployments to confirm versions and identify which systems run 3.8.2 or earlier; cross-reference with user access logs to assess risk surface. Within 7 days, segment network access to Prefect APIs from general employee networks, implement multi-factor authentication on all Prefect service accounts, and enable comprehensive audit logging on git_clone operations. Within 30 days, monitor the Prefect advisory tracker for a patched version release; prepare and test an upgrade plan now to ensure rapid deployment once a fix is published.

PrefectHQ Prefect CVE-2026-72538

EUVD-2026-56008 HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2026-08-11 TuranSec

GHSA-42fh-94w4-956q

RCE Prefect Prefecthq

8.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-accessible API, low complexity; PR:L because exploitation requires authenticated low-privilege user with deployment authoring rights; full CIA impact on the Prefect server process.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:05 vuln.today

CVE Published

Aug 11, 2026 - 11:07 cve.org

HIGH 8.8

DescriptionCVE.org

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.

AnalysisAI

Remote code execution in PrefectHQ Prefect through version 3.8.2 allows authenticated users to inject arbitrary git arguments via the unsanitized branch field of the git_clone pull step, enabling arbitrary command execution on the Prefect server. This vulnerability is a distinct bypass of the incomplete fix applied for CVE-2026-5366, meaning the earlier remediation left the underlying code path exploitable by a different injection technique. No public exploit or CISA KEV listing has been identified at time of analysis, but the low-complexity network vector and authenticated-user scope make this high-priority for any organization running self-hosted Prefect orchestration infrastructure.

Technical ContextAI

PrefectHQ Prefect is a Python-based workflow orchestration platform widely used for data pipeline automation. The git_clone pull step is a built-in deployment mechanism that retrieves flow source code from a git repository by invoking git pull during a deployment pull operation. The root cause is CWE-88 (Argument Injection or Modification): the user-supplied branch field is concatenated into the subprocess call to git pull without sanitization, argument escaping, or use of a -- end-of-options delimiter. This allows an attacker to supply a malicious value such as main --upload-pack=/path/to/binary or other argument-injection payloads that git interprets as flags, redirecting execution to attacker-controlled commands. The CPE cpe:2.3:a:prefecthq:prefect:*:*:*:*:*:*:*:* confirms the issue spans all tracked versions through 3.8.2. EUVD-2026-56008 independently validates the affected version range. The recurrence of this class of vulnerability in the same code path - first in CVE-2026-5366 and now again here - indicates the original fix was narrowly scoped rather than addressing the underlying sanitization gap.

RemediationAI

Upgrade PrefectHQ Prefect to a version beyond 3.8.2 once a patched release is published; no specific fixed release version has been independently confirmed in available data, so monitor the PrefectHQ GitHub repository at https://github.com/PrefectHQ/prefect and its release notes actively for a remediated build. As an immediate compensating control, restrict deployment authoring and modification permissions to the smallest possible set of fully trusted users, since exploitation requires the ability to create or modify a git_clone pull step configuration - tightening access controls limits the attack surface without disrupting operations. Audit existing deployment configurations for unexpected or malformed branch field values as an indicator of prior exploitation. If git_clone-based pull steps are not a business requirement, disabling or removing this deployment type eliminates the attack surface entirely, though this will break any flows currently relying on git-based deployment pulls. Server-side input validation or argument escaping around the branch parameter is the required permanent fix; client-side validation alone is insufficient.