133 matches found
prefect-cve-2026-5366
PoC: CVE-2026-5366 - PrefectGitRepository의 Git 인자 주입 취약점: commitsha를 통한 RCE로 이어지는 git 인자 주입 directories를 통한 인자 주입도 포함 버전: 3.6.23에서 취약, 3.6.25+에서 수정됨 파일: src/prefect/runner/storage.py Huntr: https://huntr.com/bounties/e2e88a0f-a8f6-49c9-94c5-e98dc385f07a CVE: CVE-2026-5366 면책 조항 이 자료는 이미 공개되고 패치된...
CVE-2026-72538
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
CVE-2026-72538
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
CVE-2026-72538
CVE-2026-72538 affects PrefectHQ Prefect up to version 3.8.2. An argument injection flaw occurs in the git_clone pull step where the branch field is passed directly to git pull without sanitization, enabling an authenticated user to achieve remote code execution on the Prefect server. The issue i...
EUVD-2026-56008
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
CVE-2026-72538 PrefectHQ Prefect - Argument Injection
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
CVE-2026-72538 PrefectHQ Prefect - Argument Injection
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
CVE-2026-72538 PrefectHQ Prefect - Argument Injection
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
PT-2026-70113
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. Thi...
CVE-2026-72538: Improper Neutralization of Argument Delimiters in a Command
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the gitclone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This...
GHSA-G6CJ-PR64-35W5 vulnerabilities
Vulnerabilities for packages: kubeflow, request-1276, py3-cassandra-medusa, in-toto, apache-beam-python-3.13-sdk, openstack-keystone-2025.2, metaflow-service, openstack-horizon-2025.1, ansible-operator-fips, superset, dask-kubernetes, openstack-glance-2025.2, openstack-horizon-2025.2,...
CVE-2026-69247 vulnerabilities
Vulnerabilities for packages: kubeflow, request-1276, py3-cassandra-medusa, in-toto, apache-beam-python-3.13-sdk, openstack-keystone-2025.2, metaflow-service, openstack-horizon-2025.1, ansible-operator-fips, superset, dask-kubernetes, openstack-glance-2025.2, openstack-horizon-2025.2,...
ROOT-APP-PYPI-CVE-2026-3515 CVE-2026-3515 in rootio-prefect - Patched by Root
Root has patched CVE-2026-3515 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-7722 CVE-2026-7722 in rootio-prefect - Patched by Root
Root has patched CVE-2026-7722 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-3514 CVE-2026-3514 in rootio-prefect - Patched by Root
Root has patched CVE-2026-3514 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-7723 CVE-2026-7723 in rootio-prefect - Patched by Root
Root has patched CVE-2026-7723 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...
PYSEC-2026-2957 Prefect has an Argument Injection issue
A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...
Prefect has an Argument Injection issue
A vulnerability in the GitHubRepository block of the prefect-github integration in Prefect version 3.6.18 allows an attacker to inject arbitrary git command-line options via the reference field. The reference field is concatenated directly into a git clone command string without proper...
Prefect Auth Bypass via endswith() Health Check Exemption
A vulnerability was detected in PrefectHQ prefect up to 3.6.21. This impacts the function endswith of the file /api/health of the component Health Check API. Performing a manipulation results in improper authentication. The attack is possible to be carried out remotely. The exploit is now public...
Prefect SSRF Bypass via DNS Rebinding in validate_restricted_url
A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...