CVE-2026-72538
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.
- Affected products
- Prefect
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 0.7% (50th percentile)
- Weakness
- CWE-88
- NVD status
- Received
- Published
- 2026-08-11
CVE-2026-72538 at NVD
No indexed exploits for CVE-2026-72538 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-72538 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.