CVE-2026-3515: Prefect GitHub Integration SSRF Vulnerability

CVE-2026-3515 Overview

CVE-2026-3515 is an argument injection vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18. The flaw allows authenticated attackers to inject arbitrary git command-line options through the reference field. Prefect concatenates the field directly into a git clone command string and then parses it with shlex.split(), enabling injection of options such as -c. Successful exploitation can lead to Server-Side Request Forgery (SSRF), credential theft, or Remote Code Execution (RCE) on the host running the Prefect worker. The issue is tracked under [CWE-88: Argument Injection].

Critical Impact
An attacker with permission to configure a GitHubRepository block can achieve RCE on the Prefect worker by injecting malicious git options through the reference field.

Affected Products

Prefect 3.6.18
prefect-github integration GitHubRepository block
aget_directory() and get_directory() methods in src/integrations/prefect-github/prefect_github/repository.py

Discovery Timeline

2026-05-24 - CVE-2026-3515 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-3515

Vulnerability Analysis

The prefect-github integration exposes a GitHubRepository block that clones a remote repository to fetch flow code at runtime. The reference field is intended to specify a branch, tag, or commit. Instead of passing the value as a discrete argument, the integration interpolates it into a shell-style command string. The resulting string is tokenized with shlex.split(), which preserves option-like tokens such as -c or --upload-pack. Because git accepts a wide range of command-line flags that change its behavior, an attacker can transform a benign clone operation into an arbitrary command execution primitive.

The vulnerability is reachable from both the asynchronous aget_directory() method and the synchronous get_directory() method. The GitLab and BitBucket integrations are not affected because they build their commands using a list of arguments, which prevents option tokens supplied as data from being interpreted as flags.

Root Cause

The root cause is unsafe construction of a subprocess command. User-controlled input from the reference field is concatenated into a command string rather than passed as a positional argument after a -- terminator. No allow-list or syntactic validation is applied before shlex.split() parses the string into tokens. This pattern is a textbook case of [CWE-88: Improper Neutralization of Argument Delimiters in a Command].

Attack Vector

An attacker with privileges to create or modify a GitHubRepository block sets the reference field to a value that begins with a git option. For example, supplying -c allows the attacker to override git configuration entries, including core.sshCommand or protocol.ext.allow, which can be abused to execute arbitrary commands when git clone runs. The --upload-pack and --config flags offer similar primitives. Because the worker process executes the resulting git command, code execution occurs in the Prefect worker context with its credentials and network access.

No verified public exploit code is currently available. See the Huntr Bounty Listing for the original vulnerability report.

Detection Methods for CVE-2026-3515

Indicators of Compromise

GitHubRepository block configurations where the reference field begins with -, --, or contains -c , --config, --upload-pack, or --exec.
Prefect worker processes spawning git clone commands with unusual flags or unexpected core.sshCommand overrides.
Outbound network connections from Prefect workers to hosts unrelated to GitHub immediately following block configuration changes.

Detection Strategies

Audit the Prefect database and API for stored GitHubRepository blocks and inspect the reference field for option-like prefixes.
Inspect process telemetry on Prefect worker hosts for git invocations whose arguments include -c, --config, --upload-pack, or --exec originating from the prefect-github integration.
Correlate child processes of the Prefect worker against an expected baseline. Shells, interpreters, or network utilities spawned under git are high-fidelity signals of exploitation.

Monitoring Recommendations

Forward Prefect API audit logs and worker process telemetry to a centralized analytics platform and alert on changes to GitHubRepository blocks.
Monitor egress traffic from Prefect workers and flag connections to hosts outside the approved Git hosting allow-list.
Track creation of new credentials, SSH keys, or environment variable reads on worker hosts after block modifications.

How to Mitigate CVE-2026-3515

Immediate Actions Required

Inventory all Prefect deployments running version 3.6.18 with the prefect-github integration installed.
Review every existing GitHubRepository block and remove or sanitize any reference field value that begins with - or contains git option syntax.
Restrict who can create or modify storage blocks in the Prefect API to a small set of trusted users.
Rotate any credentials or tokens stored on or accessible from Prefect worker hosts if exploitation is suspected.

Patch Information

No fixed version is referenced in the published NVD entry at the time of writing. Monitor the Huntr Bounty Listing and the Prefect project release notes for an official patch. Once available, upgrade prefect-github to a version that constructs the git command from an argument list and validates the reference value against an allow-list of branch, tag, or commit syntax.

Workarounds

Replace GitHubRepository blocks with the GitLab or BitBucket integrations where feasible, since they use list-based command construction and are not affected.
Apply input validation at the application layer to reject reference values that match ^- or contain whitespace before persistence.
Run Prefect workers as unprivileged users in isolated containers with strict egress network policies to limit the blast radius of any successful injection.

bash

# Configuration example: validate the reference field before assignment
# Reject any value that looks like a git option or contains shell metacharacters
REF="$1"
if [[ "$REF" =~ ^- ]] || [[ "$REF" =~ [[:space:]\;\&\|\$\`] ]]; then
  echo "Invalid git reference: $REF" >&2
  exit 1
fi