Executive brief
Prefect, a workflow orchestration platform used to manage data pipelines, contains a vulnerability that allows remote code execution. An attacker with basic permissions to create deployments can exploit improper input handling to run unauthorized commands on the worker machines that execute tasks. This could lead to a complete takeover of the infrastructure, data theft, or disruption of business operations, especially in environments where multiple teams share the same resources.
Technical details
A remote code execution vulnerability exists in Prefect's `GitRepository` storage class due to improper validation of the `commit_sha` and `directories` parameters. These parameters are passed directly to git commands without a `--` separator, allowing an attacker to inject git flags such as `--upload-pack`. By providing a malicious flag, an authenticated user with deployment creation permissions can trigger the execution of arbitrary external programs on the worker node. This is particularly impactful in multi-tenant environments where shared work pools can be compromised. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code).
Affected products
- PrefectHQ Prefect 3.6.23 and earlier
Timeline
- 2026-06-20: disclosed
- 2026-06-20: advisory