Remote Code Execution in Prefect by Prefect Technologies

CVE-2026-5366

What is CVE-2026-5366?

Prefect version 3.6.23 is susceptible to remote code execution, primarily due to inadequate validation of user-controlled inputs within the GitRepository storage class. The issue stems from the commit_sha parameter, which is improperly processed without adequate safeguards, allowing attackers to inject arbitrary git commands. This vulnerability can enable the execution of unauthorized programs on worker machines, particularly in shared setups commonly associated with multi-tenant environments. Attackers with the permissions to create deployments can exploit this flaw, leading to potential system compromises.

References