Git Argument Injection in Prefect Pull Steps

CVE-2026-72538 is an argument injection vulnerability affecting PrefectHQ Prefect versions through 3.8.2 that allows authenticated users to execute arbitrary commands on the Prefect server. The vulnerability exists in the git_clone pull step, where the branch parameter is passed directly to git pull without input sanitization. An attacker with authentication credentials can inject malicious git arguments through the branch field, bypassing the previous incomplete fix for CVE-2026-5366. This vulnerability is particularly dangerous because it targets workflow automation infrastructure—commonly used for deployment pipelines and CI/CD processes—making successful exploitation a direct path to compromising production systems and supply chains.

While MITRE ATT&CK techniques are not explicitly mapped to this CVE, Casky's security skills would detect the underlying attack patterns associated with command injection and code execution. A practitioner using Casky's Claude-powered analysis would identify this as consistent with Execution techniques, particularly T1059 (Command and Scripting Interpreter) and T1190 (Exploit Public-Facing Application). The analysis would flag suspicious patterns in git command construction, input validation gaps in parameter handling, and the presence of unsanitized user-supplied data flowing into system commands. Practitioners would see findings highlighting the need for strict input validation on all git parameters, implementation of allowlist-based branch validation, and consideration of sandboxing pull step execution to limit lateral movement if the Prefect server is compromised.