CVE-2026-7725: PrefectHQ Prefect RCE Vulnerability

CVE-2026-7725 Overview

CVE-2026-7725 is an argument injection vulnerability in PrefectHQ Prefect, an open-source workflow orchestration platform. The flaw resides in the GitRepository pull handler implemented in src/prefect/runner/storage.py. Attackers can manipulate the commit_sha and directories arguments to inject arbitrary parameters into git command invocations. The issue affects Prefect versions up to and including 3.6.25.dev6 and is resolved in 3.6.25.dev7 via commit 6a9d9918716ce4ee0297b69f3046f7067ef1faae. The vulnerability is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. A public exploit reference exists, and the issue is exploitable remotely by an authenticated low-privileged user.

Critical Impact
Authenticated remote attackers can inject malicious arguments into git operations performed by Prefect runners, potentially altering repository pull behavior and impacting workflow integrity.

Affected Products

PrefectHQ Prefect versions up to 3.6.25.dev6
The GitRepository pull handler component in src/prefect/runner/storage.py
Prefect runner deployments that pull workflow code from git repositories

Discovery Timeline

2026-05-04 - CVE-2026-7725 published to NVD
2026-05-05 - Last updated in NVD database

Technical Details for CVE-2026-7725

Vulnerability Analysis

The vulnerability stems from unsafe handling of user-controlled values passed as arguments to git command-line invocations within the GitRepository storage class. Prefect uses subprocess calls to clone and check out repositories referenced by deployments. When the commit_sha or directories parameters are supplied by an attacker, those values are concatenated into the git command without proper validation against argument-style inputs that begin with hyphens. This permits an attacker to smuggle additional git options into the executed command, an issue commonly described as argument injection rather than direct command injection.

Root Cause

The root cause is missing input validation on the commit_sha and directories arguments before they are forwarded to subprocess calls invoking the git binary. Without sanitization, values resembling git flags such as --upload-pack or --config can alter the git command's behavior. The patch introduces the re module and warnings module to src/prefect/runner/storage.py to enforce regular-expression-based validation on these arguments.

Attack Vector

Exploitation requires network access and low-privileged authenticated access to a Prefect instance where an attacker can influence deployment configuration. By supplying a crafted commit_sha or directories value, the attacker controls additional git arguments at runtime on the Prefect runner. The CVSS 4.0 vector indicates limited confidentiality, integrity, and availability impact on the vulnerable system, with no impact propagated to subsequent systems.

python

 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
+import warnings
 from copy import deepcopy
 from pathlib import Path
 from typing import (

Source: PrefectHQ/prefect commit 6a9d991 — the patch adds the re module to enable regex-based validation of git arguments and the warnings module to surface unsafe input to operators.

Detection Methods for CVE-2026-7725

Indicators of Compromise

Prefect deployment definitions containing commit_sha or directories values that begin with hyphens or contain git option syntax such as --upload-pack= or --config.
Unexpected git subprocess invocations from Prefect runner hosts referencing non-standard remote helpers or external binaries.
Outbound network connections from Prefect runners to hosts not associated with configured git remotes.

Detection Strategies

Audit Prefect deployment manifests and API records for any GitRepository configuration where commit_sha does not match a 40-character hexadecimal pattern.
Inspect process execution telemetry on runner hosts for git commands containing suspicious option-style arguments injected through Prefect.
Compare installed Prefect package versions against 3.6.25.dev7 or later across orchestration infrastructure.

Monitoring Recommendations

Forward Prefect runner host process execution and command-line arguments to a centralized logging or SIEM platform for retrospective hunting.
Alert on Prefect API requests that create or update GitRepository storage blocks with non-conforming commit_sha or directories values.
Track outbound traffic from Prefect runners and flag connections that deviate from approved git hosting providers.

How to Mitigate CVE-2026-7725

Immediate Actions Required

Upgrade all Prefect installations to version 3.6.25.dev7 or later, which includes the fix in pull request #21384.
Review existing deployments that use GitRepository storage and validate that commit_sha and directories values are well-formed.
Restrict Prefect API access so that only trusted users can create or modify deployment configurations referencing git storage.

Patch Information

The vendor released the fix as commit 6a9d9918716ce4ee0297b69f3046f7067ef1faae, available in the 3.6.25.dev7 release. The patch validates commit_sha and directories arguments before passing them to git subprocess calls. Additional context is available in the VulDB entry #360901.

Workarounds

Block deployment creation paths that accept untrusted commit_sha or directories values until the upgrade is completed.
Constrain runner host outbound network egress to known git providers to limit downstream impact of injected arguments.
Run Prefect runners under least-privileged service accounts with no access to sensitive credentials beyond what is required for workflow execution.

bash

# Upgrade Prefect to a fixed version
pip install --upgrade "prefect>=3.6.25.dev7"

# Verify the installed version
prefect version