# CVE-2026-72538: PrefectHQ Prefect argument injection in git_clone pull step

Source: https://junglewise.ai/threats/cve-2026-72538-prefecthq-prefect-argument-injection-in-git-clone-pull-step  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72538 · Severity: high · CVSS 8.8 · Published 2026-08-11

Prefect is a workflow orchestration framework that manages data pipelines and automation tasks. An authenticated user can inject arbitrary git arguments via the branch parameter in git operations, leading to remote code execution on the Prefect server. This could allow an attacker with valid credentials to execute malicious code and compromise the server or connected systems.

## Quick answers

**Is CVE-2026-72538 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72538 being exploited in the wild.

**How severe is CVE-2026-72538?** High severity, with a CVSS score of 8.8, published 11 August 2026.

**Which products and versions are affected?** PrefectHQ Prefect through 3.8.2.

**Is there a fix for CVE-2026-72538?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72538 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-72538?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An argument injection vulnerability exists in the git_clone pull step where the branch parameter is passed directly to git pull without sanitization. This allows authenticated attackers to inject arbitrary git arguments and achieve remote code execution on the Prefect server. The vulnerability is a distinct code path from the incomplete fix applied for CVE-2026-5366. Attack requires authentication but can lead to full server compromise through command execution.

## Affected products

- PrefectHQ Prefect through 3.8.2

## Timeline

- 2026-08-11: disclosed

## References

- [https://github.com/PrefectHQ/prefect](https://github.com/PrefectHQ/prefect)