CVE-2026-72538 — PrefectHQ Prefect - Argument Injection

CVE-2026-72538

PrefectHQ Prefect - Argument Injection PUBLISHED

Description (CNA)

An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.

Affected (CNA)

Vendor / product	Versions
PrefectHQ / Prefect	affected 0 through 3.8.2

CWE

CWE-88

References

https://github.com/PrefectHQ/prefect

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.