CVE-2026-5366

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the "GitRepository" storage class. The "commitsha" parameter, which is passed to git commands, lacks validation and does not include a "--" separator to distinguish user input from g...

CVE-2026-5366 Git Argument Injection in prefecthq/prefect

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commitsha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git...

PT-2026-51161

Name of the Vulnerable Software and Affected Versions Prefect version 3.6.23 Description Remote code execution is possible due to improper handling of user-controlled input within the GitRepository storage class. The commit sha parameter is passed to git commands without validation and lacks a --...

CVE-2026-5366: Improper Control of Generation of Code

Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input in the GitRepository storage class. The commitsha parameter, which is passed to git commands, lacks validation and does not include a -- separator to distinguish user input from git...

CVE-2026-7724

A vulnerability has been found in PrefectHQ prefect up to 3.6.28.dev1. Affected by this vulnerability is the function validaterestrictedurl of the component Webhook/Notification. The manipulation leads to time-of-check time-of-use. It is possible to initiate the attack remotely. The attack is...

CVE-2026-7723

A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The exploit has been published and may be...

CVE-2026-3514

In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes. Specifically, the authentication middleware exempts any URL path ending with 'health' or 'ready' from authentication checks. This allo...

ROOT-APP-PYPI-CVE-2024-8183 CVE-2024-8183 in prefect - Patched by Root

Root has patched CVE-2024-8183 in the prefect package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-6022 CVE-2023-6022 in prefect - Patched by Root

Root has patched CVE-2023-6022 in the prefect package for Root:PyPI. Multiple fixed versions available...

Incorrect Authorization

Overview prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Incorrect...

ai-24sea (>=0.1.0, <=1.1.1), clerk-sdk (0.1.0) +30 more potentially affected by CVE-2026-3514 via prefect (>=3.0.0rc20, <=3.6.19)

prefect PYPI version =3.0.0rc20, =0.1.0, =1.0.1, =2.2.8, =2.25.0rc1, =0.1.31, =1.1.0b2, =1.3.0b5, =0.0.2, =0.1.11, =1.1.0, =3.0.0, =0.0.2, =0.2.2 and more Source cves: CVE-2026-3514 Source advisory: SNYK:PYTHON-PREFECT-17751547...

edx-prefectutils (>=1.0.7, <=2.0.0) potentially affected by CVE-2026-3514 via prefect (0.14.5)

prefect PYPI version 0.14.5 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =1.0.7, =2.0.0 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

nflpocketarea2023 (>=0.0.5, <=0.0.7) potentially affected by CVE-2026-3514 via prefect (2.7.12)

prefect PYPI version 2.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - nflpocketarea2023 =0.0.5, =0.0.7 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

ert (>=2.37.0, <=5.1.0b1), sagetasks (>=0.1.0a0, <=0.1.0a5) potentially affected by CVE-2026-3514 via prefect (2.0.0b16)

prefect PYPI version 2.0.0b16 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - ert =2.37.0, =0.1.0a0, =0.1.0a5 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

assemblit (>=0.1.11, <=0.1.13) potentially affected by CVE-2026-3514 via prefect (2.16.6)

prefect PYPI version 2.16.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - assemblit =0.1.11, =0.1.13 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

edx-prefectutils (>=2.0.1, <=2.3.8) potentially affected by CVE-2026-3514 via prefect (0.15.1)

prefect PYPI version 0.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - edx-prefectutils =2.0.1, =2.3.8 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

orchestration-utils (0.0.1) potentially affected by CVE-2026-3514 via prefect (2.17.1)

prefect PYPI version 2.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - orchestration-utils 0.0.1 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

softpack-builder (0.1.0), softpack-core (0.1.0) potentially affected by CVE-2026-3514 via prefect (2.8.6)

prefect PYPI version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - softpack-builder 0.1.0 - softpack-core 0.1.0 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

giza-sdk (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-3514 via prefect (2.14.6)

prefect PYPI version 2.14.6 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - giza-sdk =0.1.0, =0.1.2 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...

simmate (>=0.7.0, <=0.7.1) potentially affected by CVE-2026-3514 via prefect (2.0.0b8)

prefect PYPI version 2.0.0b8 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - simmate =0.7.0, =0.7.1 Source cves: CVE-2026-3514 Source advisory: OSV:GHSA-C635-393C-HCX2...