What is CVE-2026-72538?
CVE-2026-72538 is an argument injection vulnerability in PrefectHQ Prefect up to version 3.8.2, allowing authenticated users to achieve remote code execution via the 'git_clone pull step'. The 'branch' parameter is passed directly to 'git pull' without sanitization, enabling injection of arbitrary git arguments. Upgrading to the latest version is strongly recommended.
Azərbaycanca: CVE-2026-72538, PrefectHQ Prefect-in 3.8.2 versiyasına qədər olan versiyalarında autentifikasiya olunmuş istifadəçilərə 'git_clone pull step' vasitəsilə uzaqdan kod icrası (RCE) imkanı verən arqument inyeksiyası zəifliyidir. 'branch' parametri sanitizasiya edilmədən birbaşa 'git pull' əmrinə ötürüldüyü üçün zərərli git arqumentləri yeridilə bilər. Bu zəiflikdən qorunmaq üçün Prefect-i ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-77
FAQ2
What threat does CVE-2026-72538 pose in PrefectHQ Prefect?
CVE-2026-72538 is an argument injection vulnerability that allows authenticated users to achieve remote code execution via the 'git_clone pull step', caused by the 'branch' parameter being passed directly to 'git pull' without sanitization.
How can one protect against CVE-2026-72538?
Upgrading Prefect to the latest version is strongly recommended to mitigate this vulnerability.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.