CVE-2026-5366: Prefect GitRepository git argument injection leading to remote code execution
CVE-2026-5366 affects Prefect version 3.6.23 and is described as allowing remote code execution through unvalidated input in the GitRepository storage class. The record reports that user-controlled values reach git commands without a separator, allowing git flags to be injected. The CNA rates it critical with a CVSS 3.0 score of 9.9, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-5366 is a code injection weakness (CWE-94) in Prefect 3.6.23. According to the record, the GitRepository storage class passes the commit_sha parameter to git commands without validation and without a separator that distinguishes user input from git options. The record also says the directories parameter can be abused in a similar way during sparse-checkout operations.
Impact
The record states that a user with permission to create deployments can execute arbitrary commands on worker machines. It also states that this affects shared work pools in multi-tenant environments. The CNA scored the issue 9.9 (critical) under CVSS 3.0, with high confidentiality, integrity and availability impact and a scope change.
Affected products and versions
- Prefect (vendor listed as Prefect Prefect): version 3.6.23, as stated in the record.
- The record does not list other affected versions, so the range of impacted releases is unknown.
Exploitation status
The CISA KEV catalog does not list this CVE, so no active exploitation is confirmed by that source. The huntr reference is tagged as Exploit in the record, but this analysis does not describe any exploitation method. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- The record contains no fixed version. The absence of a fix in the record does not mean none exists; check the Prefect project and vendor channels for an update beyond 3.6.23.
- Until a fix is confirmed, restrict who can create deployments and review which users hold that permission.
- Isolate worker machines and avoid sharing work pools across tenants where trust boundaries are not enforced.
- Limit the credentials and network access available to workers, so that a compromised worker has a smaller blast radius.
Detection guidance
- Review deployment definitions for unexpected values in commit_sha and directories fields, especially values beginning with a hyphen.
- Monitor worker hosts for unexpected child processes spawned by Prefect or git processes.
- Audit recent deployment creation events and the users who performed them.
Limitations of the available information
- The title was not provided in the record and has been written from the description.
- No vendor advisory, fixed version, or patch reference is included in the record.
- Only a CNA-provided CVSS 3.0 score is present; no NVD or other provider score is included, and no EPSS or SSVC data is available.
- The exact set of affected versions beyond 3.6.23 is unknown.
Frequently asked questions
Which Prefect version is affected by CVE-2026-5366?
The record lists Prefect version 3.6.23. Other affected versions are not stated in the sources consulted.
Is CVE-2026-5366 known to be exploited in the wild?
The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.
Is there a fixed version available?
The record does not include a fixed version. Check the Prefect project and vendor channels for an update, since the absence of a fix in the record does not prove none exists.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.