CVE-2026-72538: high vulnerability (CVSS 8.8)
CVE-2026-72538 exploits unsanitized branch parameters in PrefectHQ Prefect (<=3.8.2), enabling authenticated users to inject arbitrary git arguments during git_clone pull steps, leading to remote code execution. This bypasses fixes for CVE-2026-5366 and impacts Prefect servers.
Ensure all git-related inputs are sanitized and validate user-supplied parameters rigorously. Deploy patches immediately and monitor for unusual git activity to mitigate exploitation risks.
The vulnerability stems from improper sanitization of the branch field in git_clone pull steps within PrefectHQ Prefect versions up to 3.8.2. Authenticated users can inject arbitrary git arguments, which are executed during git pull operations.
This issue bypasses the incomplete fix for CVE-2026-5366, exposing Prefect servers to remote code execution risks. Attackers can exploit this flaw to execute commands with server privileges.
Admins should apply the latest patches, implement strict input validation for git-related fields, and monitor server logs for anomalous git activity to prevent exploitation.