CVE-2026-5366: Prefect GitRepository RCE Vulnerability

CVE-2026-5366 Overview

Prefect version 3.6.23 contains a remote code execution vulnerability in the GitRepository storage class. The flaw stems from improper handling of user-controlled input passed to git commands. The commit_sha parameter lacks input validation and omits the -- separator that distinguishes arguments from git flags. Attackers can inject git flags such as --upload-pack to execute arbitrary external programs. The directories parameter exhibits the same weakness during sparse-checkout operations. Any user with deployment creation permissions can execute arbitrary commands on worker machines, which compromises shared work pools in multi-tenant Prefect deployments. The issue is tracked as [CWE-94] Improper Control of Generation of Code.

Critical Impact
Authenticated users with deployment creation rights can achieve remote code execution on Prefect worker machines, breaking tenant isolation in shared work pools.

Affected Products

Prefect 3.6.23
Prefect GitRepository storage class
Prefect worker machines in multi-tenant work pools

Discovery Timeline

2026-06-20 - CVE-2026-5366 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-5366

Vulnerability Analysis

The vulnerability resides in the GitRepository storage class used by Prefect to fetch deployment code from git repositories. Prefect passes the commit_sha parameter directly into a git command-line invocation without sanitization. The invocation also omits the -- end-of-options separator that git uses to distinguish positional arguments from flags. As a result, a value beginning with -- is interpreted by git as a flag rather than a commit reference. The directories parameter, consumed during sparse-checkout operations, shares the same argument-injection weakness.

Root Cause

The root cause is improper neutralization of user-supplied input passed as command-line arguments to a subprocess. Two conditions combine to enable exploitation: missing validation of the commit_sha and directories values, and absence of the -- separator in the constructed git command. Either control would have prevented the flag-injection primitive.

Attack Vector

An attacker submits a malicious deployment configuration in which commit_sha or directories begins with a git flag. Git options such as --upload-pack=<command> cause git to execute the supplied program when contacting a remote. When the Prefect worker pulls the deployment, git executes the attacker-controlled program under the worker process identity. In multi-tenant environments, this provides cross-tenant code execution on the shared worker host. Network reachability to the Prefect API combined with the low privilege requirement of deployment creation produces a high-impact path to arbitrary command execution. Technical details are documented in the Huntr Bounty Report.

Detection Methods for CVE-2026-5366

Indicators of Compromise

Deployment definitions where commit_sha or directories fields begin with -- or contain git flag syntax such as --upload-pack, --receive-pack, or --config
Worker host processes spawned as children of git that are not standard git helpers
Outbound network connections from worker hosts to unexpected endpoints following a deployment pull
Git operations referencing commit SHAs that fail format validation as 40-character hexadecimal strings

Detection Strategies

Inspect Prefect API audit logs for deployment create or update operations containing suspicious parameter values in GitRepository storage configuration
Alert on process executions where git invokes subprocesses outside the expected toolchain on worker machines
Apply regular expression validation that flags any deployment field beginning with - before runtime

Monitoring Recommendations

Forward Prefect server and worker logs to a centralized analytics platform and retain deployment configuration history for forensic review
Monitor worker host process trees for anomalous git child processes and unexpected shell invocations
Track outbound connections initiated by worker processes during deployment pulls and baseline normal git remote endpoints

How to Mitigate CVE-2026-5366

Immediate Actions Required

Upgrade Prefect to a fixed release once published by the maintainers and review the Huntr Bounty Report for the latest remediation status
Restrict deployment creation permissions to trusted users and audit existing role assignments in multi-tenant environments
Isolate work pools per tenant so a single compromised worker cannot affect other tenants
Review existing deployments for GitRepository configurations containing flag-like values in commit_sha or directories

Patch Information

Refer to the Huntr Bounty Report for fix availability and version guidance. A complete remediation requires validating that commit_sha matches a strict hexadecimal pattern, rejecting directories values that begin with -, and inserting the -- separator in all git command constructions.

Workarounds

Implement an admission control layer that rejects deployment submissions where commit_sha does not match ^[0-9a-fA-F]{7,40}$ or where directories entries begin with -
Run Prefect workers in single-tenant work pools or in ephemeral, sandboxed containers with no persistent secrets
Remove network egress from worker hosts to anything other than approved git remotes to limit the impact of --upload-pack style injections

bash

# Configuration example: validate deployment parameters before submission
# Reject any commit_sha that is not a valid git hex SHA
if ! [[ "$COMMIT_SHA" =~ ^[0-9a-fA-F]{7,40}$ ]]; then
  echo "Invalid commit_sha: $COMMIT_SHA" >&2
  exit 1
fi

# Reject directory entries that start with a dash
for d in "${DIRECTORIES[@]}"; do
  if [[ "$d" == -* ]]; then
    echo "Invalid directory entry: $d" >&2
    exit 1
  fi
done