EUVD-2026-38128
GHSA-7pm4-56h2-5rxr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable Prefect API, low-priv deployment author (PR:L), no UI; argument injection breaks out of Prefect's auth scope onto the worker (S:C) with full RCE giving high CIA.
Primary rating from Vendor (huntr_ai).
CVSS VectorVendor: huntr_ai
Lifecycle Timeline
1DescriptionCVE.org
Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commit_sha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git flags. This allows attackers to inject arbitrary git flags, such as --upload-pack, enabling execution of external programs. Additionally, the directories parameter can be exploited to inject git flags during sparse-checkout operations. These vulnerabilities allow any user with deployment creation permissions to execute arbitrary commands on worker machines, compromising shared work pools in multi-tenant environments.
AnalysisAI
Remote code execution in Prefect 3.6.23 allows any user holding deployment-creation permissions to run arbitrary commands on shared worker machines by abusing the GitRepository storage class. The commit_sha and directories parameters are concatenated into git invocations without a -- separator or validation, letting attackers smuggle flags such as --upload-pack to execute external programs. No public exploit identified at time of analysis, but the bug was reported via huntr and is particularly dangerous for multi-tenant work pools where worker compromise crosses trust boundaries.
Technical ContextAI
Prefect is an open-source workflow orchestration platform from PrefectHQ (CPE cpe:2.3:a:prefecthq:prefecthq/prefect) where deployments can pull flow code from a Git repository via the GitRepository storage class. That class shells out to git with user-supplied values for commit_sha (used with checkout/fetch) and directories (used with sparse-checkout), and because git treats any argument beginning with -- as an option, omitting the -- end-of-options sentinel turns those positional inputs into option-injection sinks. The root cause maps to CWE-94 (Improper Control of Generation of Code) - specifically argument injection into a subprocess - and flags like git fetch --upload-pack=<cmd> or --exec=<cmd> cause git to spawn an arbitrary external program with the worker's privileges.
RemediationAI
No vendor-released patch identified at time of analysis; monitor https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a, https://nvd.nist.gov/vuln/detail/CVE-2026-5366, and the PrefectHQ release notes for a fixed version above 3.6.23 and upgrade as soon as it is published. Until then, the most effective compensating control is to stop accepting untrusted commit_sha and directories values: restrict deployment-creation permissions to a small, trusted set of operators in shared work pools (side effect - collaborators lose self-service deployments), or pre-define deployments centrally and have low-trust users only trigger them. Operators can also isolate workers per tenant so a successful injection only compromises that tenant's runner, run workers as unprivileged users in ephemeral containers with no outbound egress beyond the required Git remote, and add an admission check that rejects commit_sha or directories values containing - as a leading character or = mid-string - recognising this is a fragile denylist that may break legitimate but unusual branch/path inputs.
More in Prefecthq Prefect
View allCommand injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Authentication bypass in prefecthq/prefect 3.6.19 allows remote unauthenticated attackers to access sensitive API endpoi
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today