PT-2026-51161 · Prefecthq · Prefecthq/Prefect

Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-5366

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prefect version 3.6.23

Description Remote code execution is possible due to improper handling of user-controlled input within the GitRepository storage class. The commit sha parameter is passed to git commands without validation or the use of a -- separator to distinguish user input from git flags. This allows the injection of arbitrary git flags, such as --upload-pack, to execute external programs. Furthermore, the directories parameter can be exploited to inject git flags during sparse-checkout operations. Users with deployment creation permissions can leverage these flaws to execute arbitrary commands on worker machines, which may compromise shared work pools in multi-tenant environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-5366

Affected Products

Prefecthq/Prefect

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-5366 · Security Note
• https://twitter.com/infoflowcloud/status/2068382364993016049 · Twitter Post
• https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a · Note
• https://twitter.com/CVEnew/status/2068380896604926247 · Twitter Post