CVE-2026-5366: Git Argument Injection in prefecthq/prefect

Synopsis

An argument injection vulnerability in Prefect version 3.6.23 allows remote code execution through the GitRepository storage class. The flaw exists because the commit_sha and directories parameters are passed directly to git commands without validation or a -- separator, letting an attacker inject arbitrary git flags such as --upload-pack to launch external programs. This is reachable over the network by any authenticated user with deployment creation permissions, and successful exploitation gives the attacker arbitrary command execution on worker machines. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable Prefect API endpoint is exposed over the network, so an attacker must be able to reach the service remotely to inject malicious parameters.

• AuthenticationRequired

  Any low-privilege account with deployment creation permissions is sufficient; no administrator or privileged role is needed.

• Victim interactionNot required

  No user interaction is needed; the attacker supplies malicious input directly through the API.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to inject the malicious git flag.

Blast Radius

• Executes arbitrary commands on worker machines by injecting git flags that spawn external programs during repository fetch operations.
• Reads secrets, credentials, and environment variables accessible to the worker process, including those used to authenticate against downstream services.
• Modifies or destroys data reachable by the worker, including persisted deployment configs, result storage, and shared work-pool state.
• Compromises the entire shared work pool in multi-tenant environments, meaning one malicious tenant can affect workloads belonging to other tenants on the same pool.