High
PrefectHQ Prefect - Argument Injection
Type: advisorySources: OSV
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-72538
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:42 UTC · Revision 1
Source evidence
An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.
osv:CVE-2026-72538
Complete source record
{
"id": "c102a7ec34e85f1cfabacc29cfc3dcd14d4b9426980e51c7029997b7387bc51b",
"url": "https://osv.dev/vulnerability/CVE-2026-72538",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "PrefectHQ Prefect - Argument Injection",
"summary": "An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling injection of arbitrary git arguments. This represents a distinct code path from the incomplete fix applied for CVE-2026-5366 and allows command execution on the Prefect server.",
"evidence": "osv:CVE-2026-72538",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-72538",
"aliases": [
"CVE-2026-72538"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/prefecthq/prefect",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "b535a27ea1b567bd0363b94617fc2502a56d23c8"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.8.2"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.8.2"
}
],
"source": "DESCRIPTION"
}
]
}
}
],
"versions": [
"3.8.2",
"3.8.2.dev6",
"3.8.2.dev5",
"3.8.2.dev4",
"prefect-slack-0.4.0",
"prefect-redis-0.2.14",
"prefect-kubernetes-0.7.12",
"prefect-aws-0.7.11",
"3.8.2.dev3",
"3.8.2.dev2",
"3.8.2.dev1",
"3.8.1",
"3.8.1.dev5",
"3.8.1.dev4",
"3.8.1.dev3",
"3.8.1.dev2",
"3.8.1.dev1",
"3.8.0",
"3.7.9.dev7",
"3.7.9.dev6",
"3.7.9.dev5",
"3.7.9.dev4",
"prefect-aws-0.7.10",
"3.7.9.dev3",
"prefect-redis-0.2.13",
"prefect-kubernetes-0.7.11",
"prefect-gcp-0.6.21",
"prefect-docker-0.7.3",
"prefect-azure-0.4.12",
"prefect-databricks-0.4.2",
"3.7.9.dev2",
"3.7.9.dev1",
"3.7.8",
"3.7.8.dev4",
"3.7.8.dev3",
"3.7.8.dev2",
"3.7.8.dev1",
"3.7.7",
"3.7.7.dev2",
"3.7.7.dev1",
"3.7.6",
"3.7.5.dev4",
"3.7.6.dev4",
"3.7.6.dev3",
"prefect-databricks-0.4.1",
"3.7.6.dev2",
"3.7.6.dev1",
"3.7.5",
"3.7.5.dev6",
"3.7.5.dev5",
"prefect-gitlab-0.3.5",
"prefect-github-0.4.4",
"prefect-bitbucket-0.3.7",
"3.7.5.dev3",
"3.7.5.dev2",
"3.7.5.dev1",
"prefect-snowflake-0.28.8",
"prefect-shell-0.3.6",
"prefect-redis-0.2.12",
"prefect-kubernetes-0.7.10",
"prefect-github-0.4.3",
"prefect-gcp-0.6.20",
"prefect-dbt-0.7.25",
"prefect-dask-0.3.7",
"prefect-azure-0.4.11",
"3.7.4",
"3.7.4.dev4",
"3.7.4.dev3",
"3.7.4.dev2",
"3.7.4.dev1",
"3.7.3",
"3.7.3.dev5",
"3.7.3.dev7",
"3.7.3.dev6",
"prefect-gcp-0.6.19",
"3.7.3.dev4",
"3.7.3.dev3",
"3.7.3.dev2",
"3.7.3.dev1",
"3.7.2",
"3.7.2.dev4",
"3.7.2.dev5",
"3.7.2.dev3",
"3.7.2.dev2",
"3.7.2.dev1",
"prefect-ray-0.5.0",
"3.7.1",
"prefect-aws-0.7.9",
"3.7.1.dev9",
"3.7.1.dev8",
"3.7.1.dev7",
"3.7.1.dev6",
"3.7.1.dev5",
"3.7.1.dev4",
"3.7.1.dev3",
"3.7.1.dev2",
"3.7.1.dev1",
"prefect-kubernetes-0.7.9",
"prefect-gcp-0.6.18",
"prefect-docker-0.7.2",
"prefect-azure-0.4.10",
"prefect-aws-0.7.8",
"3.7.0",
"3.6.30.dev4",
"3.6.30.dev3",
"3.6.30.dev2",
"3.6.30.dev1",
"3.6.29",
"prefect-dbt-0.7.24",
"3.6.29.dev4",
"3.6.29.dev3",
"3.6.29.dev2",
"3.6.29.dev1",
"prefect-redis-0.2.11",
"3.6.28",
"3.6.28.dev6",
"3.6.28.dev5",
"3.6.28.dev4",
"prefect-dbt-0.7.23",
"3.6.28.dev3",
"3.6.28.dev2",
"prefect-kubernetes-0.7.8",
"3.6.28.dev1",
"3.6.27",
"prefect-dbt-0.7.22",
"3.6.27.dev5",
"3.6.27.dev4",
"prefect-dbt-0.7.21",
"3.6.27.dev3",
"3.6.27.dev2",
"3.6.27.dev1",
"3.6.26",
"3.6.26.dev6",
"3.6.26.dev5",
"3.6.26.dev4",
"3.6.26.dev3",
"prefect-kubernetes-0.7.7",
"3.6.26.dev2",
"3.6.26.dev1",
"3.6.25.dev7",
"prefect-redis-0.2.10",
"3.6.25",
"3.6.25.dev6",
"3.6.25.dev5",
"prefect-aws-0.7.7",
"3.6.25.dev4",
"3.6.25.dev3",
"3.6.25.dev2",
"3.6.25.dev1",
"3.6.24",
"3.6.24.dev5",
"3.6.24.dev4",
"3.6.24.dev3",
"3.6.24.dev2",
"3.6.24.dev1",
"prefect-aws-0.7.6",
"3.6.23",
"prefect-kubernetes-0.7.6",
"3.6.22.dev8",
"3.6.23.dev4",
"3.6.23.dev3",
"3.6.23.dev2",
"prefect-redis-0.2.9",
"3.6.23.dev1",
"3.6.22",
"3.6.22.dev7",
"3.6.22.dev6",
"prefect-shell-0.3.5",
"prefect-shell-0.3.4",
"3.6.22.dev5",
"3.6.22.dev4",
"3.6.22.dev3",
"3.6.22.dev2",
"3.6.22.dev1",
"prefect-dbt-0.7.20",
"3.6.21",
"3.6.21.dev5",
"3.6.21.dev4",
"3.6.21.dev3",
"prefect-dbt-0.7.19",
"3.6.21.dev2",
"3.6.21.dev1",
"3.6.20",
"3.6.20.dev5",
"3.6.20.dev4",
"3.6.20.dev3",
"3.6.20.dev2",
"3.6.20.dev1",
"3.6.19",
"3.6.19.dev3",
"3.6.19.dev2",
"prefect-dbt-0.7.18",
"3.6.19.dev1",
"3.6.18",
"3.6.18.dev6",
"3.6.18.dev5",
"3.6.18.dev4",
"3.6.18.dev3",
"3.6.18.dev2",
"prefect-sqlalchemy-0.6.1",
"prefect-shell-0.3.3",
"prefect-kubernetes-0.7.5",
"prefect-gitlab-0.3.4",
"prefect-github-0.4.2",
"prefect-gcp-0.6.17",
"prefect-dbt-0.7.17",
"prefect-bitbucket-0.3.6",
"prefect-azure-0.4.9",
"prefect-aws-0.7.5",
"3.6.18.dev1",
"3.6.17",
"3.6.17.dev6",
"3.6.17.dev5",
"3.6.17.dev4",
"3.6.17.dev3",
"3.6.17.dev2",
"3.6.17.dev1",
"3.6.16",
"3.6.16.dev7",
"3.6.16.dev6",
"prefect-sqlalchemy-0.6.0",
"prefect-shell-0.3.2",
"prefect-kubernetes-0.7.4",
"prefect-gitlab-0.3.3",
"prefect-github-0.4.1",
"prefect-gcp-0.6.16",
"prefect-bitbucket-0.3.5",
"3.6.16.dev5",
"3.6.16.dev4",
"3.6.16.dev3",
"3.6.16.dev2",
"3.6.16.dev1",
"3.6.15",
"3.6.14",
"3.6.14.dev7",
"3.6.14.dev6",
"3.6.14.dev5",
"3.6.14.dev4",
"3.6.14.dev3",
"prefect-dbt-0.7.16",
"3.6.14.dev2",
"3.6.14.dev1",
"3.6.13",
"3.6.13.dev2",
"3.6.13.dev1",
"3.6.12",
"3.6.12.dev5",
"3.6.12.dev4",
"3.6.12.dev3",
"3.6.12.dev2",
"3.6.12.dev1",
"prefect-kubernetes-0.7.3",
"prefect-github-0.4.0",
"prefect-gcp-0.6.15",
"prefect-docker-0.7.1",
"prefect-azure-0.4.8",
"3.6.11",
"prefect-dbt-0.7.15",
"prefect-aws-0.7.4",
"3.6.11.dev5",
"3.6.11.dev4",
"prefect-gcp-0.6.14",
"3.6.11.dev3",
"prefect-gcp-0.6.13",
"3.6.11.dev2",
"3.6.11.dev1",
"3.6.10",
"prefect-aws-0.7.3",
"3.6.10.dev5",
"3.6.10.dev4",
"3.6.10.dev3",
"3.6.10.dev2",
"3.6.10.dev1",
"3.6.9",
"3.6.9.dev1",
"prefect-dbt-0.7.14",
"prefect-kubernetes-0.7.2",
"3.6.8",
"3.6.8.dev3",
"3.6.8.dev2",
"3.6.8.dev1",
"prefect-aws-0.7.2",
"prefect-redis-0.2.8",
"prefect-docker-0.7.0",
"3.6.7",
"3.6.7.dev9",
"3.6.7.dev8",
"prefect-dbt-0.7.13",
"prefect-dbt-0.7.12",
"3.6.7.dev7",
"3.6.7.dev6",
"3.6.7.dev5",
"3.6.7.dev4",
"3.6.7.dev3",
"3.6.7.dev2",
"3.6.7.dev1",
"prefect-databricks-0.4.0",
"3.6.6",
"3.6.6.dev5",
"prefect-dbt-0.7.11",
"3.6.6.dev4",
"3.6.6.dev3",
"3.6.6.dev2",
"prefect-azure-0.4.7",
"3.6.6.dev1",
"3.6.5",
"3.6.5.dev7",
"3.6.5.dev6",
"prefect-dbt-0.7.10",
"3.6.5.dev5",
"prefect-redis-0.2.7",
"3.6.5.dev4",
"3.6.5.dev3",
"3.6.5.dev2",
"3.6.5.dev1",
"3.6.4",
"3.6.4.dev1",
"prefect-dbt-0.7.9",
"3.6.3",
"prefect-gcp-0.6.12",
"3.6.3.dev3",
"3.6.3.dev2",
"prefect-snowflake-0.28.7",
"prefect-snowflake-0.28.6",
"3.6.3.dev1",
"3.6.2",
"prefect-bitbucket-0.3.4",
"3.6.2.dev1",
"3.6.1",
"prefect-kubernetes-0.7.1",
"prefect-aws-0.7.1",
"3.6.0",
"3.6.1.dev1",
"3.5.1.dev4",
"3.5.1.dev3",
"3.5.1.dev2",
"3.5.1.dev1",
"prefect-kubernetes-0.7.0",
"prefect-aws-0.7.0",
"3.5.0",
"3.4.26.dev6",
"3.4.26.dev5",
"3.4.26.dev4",
"3.4.26.dev3",
"3.4.26.dev2",
"3.4.26.dev1",
"prefect-kubernetes-0.6.6",
"prefect-gitlab-0.3.2",
"prefect-github-0.3.2",
"prefect-bitbucket-0.3.3",
"3.4.25",
"3.4.25.dev5",
"3.4.25.dev4",
"prefect-gcp-0.6.11",
"3.4.25.dev3",
"3.4.25.dev2",
"3.4.25.dev1",
"prefect-redis-0.2.6",
"prefect-azure-0.4.6",
"3.4.24",
"3.4.24.dev5",
"3.4.24.dev4",
"prefect-bitbucket-0.3.2",
"prefect-aws-0.6.0",
"3.4.24.dev3",
"3.4.24.dev2",
"3.4.24.dev1",
"3.4.23",
"3.4.23.dev3",
"3.4.23.dev2",
"3.4.23.dev1",
"3.4.22",
"3.4.21",
"3.4.21.dev5",
"3.4.21.dev4",
"3.4.21.dev3",
"3.4.21.dev2",
"3.4.21.dev1",
"3.4.20",
"3.4.20.dev2",
"3.4.20.dev1",
"prefect-redis-0.2.5",
"3.4.19",
"3.4.19.dev5",
"prefect-dbt-0.7.8",
"3.4.19.dev4",
"prefect-kubernetes-0.6.5",
"3.4.19.dev3",
"prefect-dbt-0.7.7",
"3.4.19.dev2",
"3.4.19.dev1",
"3.4.18",
"3.4.18.dev5",
"3.4.18.dev4",
"3.4.18.dev3",
"3.4.18.dev2",
"3.4.18.dev1",
"3.4.17",
"3.4.16",
"3.4.16.dev6",
"3.4.16.dev5",
"3.4.16.dev4",
"3.4.16.dev3",
"3.4.16.dev2",
"3.4.16.dev1",
"3.4.15",
"3.4.15.dev4",
"3.4.15.dev3",
"prefect-aws-0.5.16",
"prefect-aws-0.5.15",
"3.4.15.dev2",
"prefect-aws-0.5.14",
"3.4.15.dev1",
"3.4.14",
"3.4.14.dev4",
"3.4.14.dev3",
"3.4.14.dev2",
"3.4.14.dev1",
"3.4.13",
"prefect-redis-0.2.4",
"3.4.13.dev3",
"3.4.13.dev2",
"3.4.13.dev1",
"3.4.12",
"3.4.12.dev4",
"3.4.12.dev3",
"3.4.12.dev2",
"3.4.12.dev1",
"prefect-kubernetes-0.6.4",
"prefect-gcp-0.6.10",
"prefect-dbt-0.7.6",
"prefect-azure-0.4.5",
"prefect-aws-0.5.13",
"3.4.11",
"3.4.11.dev5",
"prefect-redis-0.2.3",
"3.4.11.dev4",
"3.4.11.dev3",
"prefect-kubernetes-0.6.3",
"prefect-kubernetes-0.6.2",
"3.4.11.dev2",
"3.4.11.dev1",
"prefect-dbt-0.7.5",
"prefect-gcp-0.6.9",
"3.4.10",
"3.4.10.dev1",
"3.4.9",
"prefect-aws-0.5.12",
"3.4.9.dev5",
"3.4.9.dev4",
"3.4.9.dev3",
"3.4.9.dev2",
"prefect-dbt-0.7.4",
"3.4.9.dev1",
"3.4.8",
"prefect-dbt-0.7.3",
"3.4.8.dev8",
"3.4.8.dev7",
"3.4.8.dev6",
"3.4.8.dev5",
"prefect-dbt-0.7.2",
"3.4.8.dev4",
"3.4.8.dev3",
"3.4.8.dev2",
"3.4.8.dev1",
"prefect-dbt-0.7.1",
"prefect-ray-0.4.5",
"prefect-dask-0.3.6",
"prefect-aws-0.5.11",
"3.4.7",
"3.4.7.dev9",
"prefect-dbt-0.7.0",
"3.4.7.dev8",
"3.4.7.dev7",
"3.4.7.dev6",
"3.4.7.dev5",
"3.4.7.dev4",
"3.4.7.dev3",
"3.4.7.dev2",
"prefect-snowflake-0.28.5",
"3.4.7.dev1",
"3.4.6",
"3.4.6.dev2",
"3.4.6.dev1",
"3.4.5",
"3.4.5.dev5",
"prefect-gcp-0.6.8",
"3.4.5.dev4",
"3.4.5.dev3",
"3.4.5.dev2",
"3.4.5.dev1",
"3.4.4",
"prefect-docker-0.6.6",
"3.4.4.dev2",
"3.4.4.dev1",
"3.4.3",
"3.4.3.dev2",
"prefect-sqlalchemy-0.5.3",
"3.4.3.dev1",
"prefect-kubernetes-0.6.1",
"prefect-docker-0.6.5",
"3.4.2",
"3.4.2.dev5",
"3.4.2.dev4",
"3.4.2.dev3",
"3.4.2.dev2",
"3.4.2.dev1",
"3.4.1",
"prefect-dbt-0.6.6",
"prefect-kubernetes-0.6.0",
"3.4.1.dev5",
"3.4.1.dev4",
"3.4.1.dev3",
"prefect-snowflake-0.28.4",
"3.4.1.dev2",
"3.4.1.dev1",
"3.4.0",
"3.3.8.dev4",
"3.3.8.dev3",
"3.3.8.dev2",
"3.3.8.dev1",
"3.3.7",
"3.3.7.dev1",
"prefect-docker-0.6.4",
"3.3.6",
"3.3.6.dev4",
"prefect-kubernetes-0.5.10",
"prefect-gcp-0.6.7",
"prefect-azure-0.4.4",
"prefect-aws-0.5.10",
"prefect-dask-0.3.5",
"3.3.6.dev3",
"3.3.6.dev2",
"3.3.6.dev1",
"3.3.5",
"3.3.5.dev4",
"prefect-gcp-0.6.6",
"3.3.5.dev3",
"prefect-docker-0.6.3",
"3.3.5.dev2",
"3.3.5.dev1",
"3.3.4",
"3.3.4.dev3",
"prefect-email-0.4.2",
"3.3.4.dev2",
"3.3.4.dev1",
"prefect-snowflake-0.28.3",
"3.3.3",
"3.3.3.dev1",
"3.3.2",
"3.3.2.dev2",
"3.3.2.dev1",
"prefect-ray-0.4.4",
"3.3.1",
"prefect-aws-0.5.9",
"prefect-gcp-0.6.5",
"prefect-dask-0.3.4",
"3.3.0",
"3.2.16.dev1",
"3.2.15",
"3.2.15.dev9",
"3.2.15.dev8",
"3.2.15.dev7",
"3.2.15.dev6",
"3.2.15.dev5",
"3.2.15.dev4",
"prefect-aws-0.5.8",
"prefect-azure-0.4.3",
"prefect-aws-0.5.7",
"3.2.15.dev3",
"3.2.15.dev2",
"3.2.15.dev1",
"3.2.14",
"prefect-kubernetes-0.5.9",
"3.2.14.dev4",
"prefect-aws-0.5.6",
"3.2.14.dev3",
"3.2.14.dev2",
"3.2.14.dev1",
"3.2.13",
"3.2.13.dev4",
"3.2.13.dev3",
"3.2.13.dev2",
"3.2.13.dev1",
"3.2.12.dev2",
"3.2.12",
"prefect-gcp-0.6.4",
"3.2.12.dev4",
"3.2.12.dev3",
"prefect-gcp-0.6.3",
"prefect-kubernetes-0.5.8",
"3.2.12.dev1",
"3.2.11",
"3.2.10",
"3.2.10.dev4",
"3.2.10.dev3",
"prefect-kubernetes-0.5.7",
"3.2.10.dev2",
"3.2.10.dev1",
"3.2.9",
"3.2.8",
"3.2.8.dev4",
"3.2.8.dev3",
"prefect-kubernetes-0.5.6",
"3.2.8.dev2",
"prefect-kubernetes-0.5.5",
"3.2.8.dev1",
"prefect-aws-0.5.5",
"3.2.7",
"3.2.7.dev1",
"prefect-dask-0.3.3",
"3.2.6",
"prefect-kubernetes-0.5.4",
"prefect-aws-0.5.4",
"3.2.5",
"3.2.4",
"3.2.3",
"3.2.2",
"3.2.2.dev2",
"3.2.2.dev1",
"prefect-dbt-0.7.0rc1",
"3.2.1",
"3.2.0",
"3.1.16.dev7",
"3.1.16.dev6",
"3.1.16.dev5",
"3.1.16.dev4",
"3.1.16.dev3",
"3.1.16.dev2",
"prefect-dbt-0.6.5",
"3.1.16.dev1",
"3.1.15",
"3.1.15.dev6",
"3.1.15.dev5",
"3.1.15.dev4",
"3.1.15.dev3",
"3.1.15.dev2",
"3.1.15.dev1",
"3.1.14",
"3.1.14.dev4",
"3.1.14.dev3",
"3.1.14.dev2",
"3.1.14.dev1",
"3.1.13",
"3.1.13.dev6",
"3.1.13.dev5",
"3.1.13.dev4",
"3.1.13.dev3",
"3.1.13.dev2",
"3.1.13.dev1",
"3.1.12",
"3.1.12.dev5",
"3.1.12.dev4",
"3.1.12.dev3",
"3.1.12.dev2",
"3.1.12.dev1",
"prefect-snowflake-0.28.2",
"prefect-redis-0.2.2",
"3.1.11",
"3.1.11.dev5",
"3.1.11.dev4",
"3.1.11.dev3",
"3.1.11.dev2",
"3.1.11.dev1",
"3.1.10",
"3.1.10.dev3",
"3.1.10.dev2",
"3.1.10.dev1",
"3.1.9",
"3.1.9.dev3",
"3.1.9.dev2",
"3.1.9.dev1",
"3.1.8",
"3.1.8.dev1",
"3.1.7",
"3.1.7.dev4",
"3.1.7.dev3",
"3.1.7.dev2",
"3.1.7.dev1",
"3.1.6",
"3.1.6.dev9",
"3.1.6.dev8",
"3.1.6.dev7",
"3.1.6.dev6",
"3.1.6.dev5",
"3.1.6.dev4",
"3.1.6.dev3",
"3.1.6.dev2",
"3.1.6.dev1",
"prefect-aws-0.5.3",
"3.1.5",
"3.1.5.dev5",
"3.1.5.dev4",
"3.1.5.dev3",
"3.1.5.dev2",
"3.1.5.dev1",
"3.1.4",
"prefect-azure-0.4.2",
"3.1.3",
"3.1.3.dev5",
"3.1.3.dev4",
"prefect-sqlalchemy-0.5.2",
"prefect-snowflake-0.28.1",
"prefect-slack-0.3.1",
"prefect-shell-0.3.1",
"prefect-redis-0.2.1",
"prefect-ray-0.4.3",
"prefect-gitlab-0.3.1",
"prefect-github-0.3.1",
"prefect-gcp-0.6.2",
"prefect-email-0.4.1",
"prefect-docker-0.6.2",
"prefect-dbt-0.6.4",
"prefect-databricks-0.3.2",
"prefect-dask-0.3.2",
"prefect-bitbucket-0.3.1",
"prefect-azure-0.4.1",
"prefect-aws-0.5.2",
"3.1.3.dev3",
"3.1.3.dev2",
"3.1.3.dev1",
"3.1.2",
"3.1.2.dev2",
"3.1.2.dev1",
"3.1.1",
"3.1.1.dev6",
"3.1.1.dev5",
"3.1.1.dev4",
"3.1.1.dev3",
"3.1.1.dev2",
"prefect-kubernetes-0.5.3",
"3.1.1.dev1",
"3.1.0",
"3.0.12.dev3",
"3.0.12.dev2",
"3.0.12.dev1",
"3.0.11.dev10",
"3.0.11.dev9",
"3.0.11",
"3.0.11.dev8",
"prefect-kubernetes-0.5.2",
"3.0.11.dev7",
"3.0.11.dev6",
"3.0.11.dev5",
"3.0.11.dev4",
"3.0.11.dev3",
"prefect-dbt-0.6.3",
"3.0.11.dev2",
"3.0.11.dev1",
"prefect-aws-0.5.1",
"3.0.10",
"prefect-dbt-0.6.2",
"3.0.9",
"3.0.9.dev3",
"3.0.9.dev2",
"prefect-kubernetes-0.5.1",
"3.0.9.dev1",
"3.0.8",
"3.0.7",
"3.0.6",
"3.0.5",
"3.0.5.dev4",
"3.0.5.dev3",
"3.0.5.dev2",
"3.0.5.dev1",
"prefect-ray-0.4.2",
"3.0.4",
"prefect-ray-0.4.1",
"3.0.3",
"prefect-sqlalchemy-0.5.1",
"prefect-redis-0.2.0",
"prefect-gcp-0.6.1",
"3.0.2",
"prefect-dbt-0.6.1",
"prefect-databricks-0.3.1",
"prefect-dask-0.3.1",
"prefect-docker-0.6.1",
"3.0.1",
"prefect-sqlalchemy-0.5.0",
"prefect-snowflake-0.28.0",
"prefect-slack-0.3.0",
"prefect-shell-0.3.0",
"prefect-ray-0.4.0",
"prefect-kubernetes-0.5.0",
"prefect-gitlab-0.3.0",
"prefect-github-0.3.0",
"prefect-gcp-0.6.0",
"prefect-email-0.4.0",
"prefect-docker-0.6.0",
"prefect-dbt-0.6.0",
"prefect-databricks-0.3.0",
"prefect-dask-0.3.0",
"prefect-bitbucket-0.3.0",
"prefect-azure-0.4.0",
"prefect-aws-0.5.0",
"3.0.0",
"3.0.0rc20",
"3.0.0rc19",
"3.0.0rc18",
"3.0.0rc17",
"prefect-kubernetes-0.5.0rc2",
"3.0.0rc16",
"3.0.0rc15",
"3.0.0rc14",
"prefect-gcp-0.6.0rc3",
"3.0.0rc13",
"prefect-kubernetes-0.5.0rc1",
"3.0.0rc12",
"prefect-docker-0.6.0rc4",
"3.0.0rc11",
"3.0.0rc10",
"prefect-docker-0.6.0rc3",
"prefect-sqlalchemy-0.5.0rc2",
"prefect-slack-0.3.0rc2",
"prefect-ray-0.4.0rc2",
"prefect-kubernetes-0.4.0rc3",
"prefect-github-0.3.0rc2",
"prefect-gcp-0.6.0rc2",
"prefect-docker-0.6.0rc2",
"prefect-dbt-0.6.0rc2",
"prefect-dask-0.3.0rc2",
"prefect-azure-0.4.0rc2",
"prefect-aws-0.5.0rc2",
"3.0.0rc9",
"3.0.0rc8",
"3.0.0rc7",
"3.0.0rc6",
"prefect-kubernetes-0.4.0rc2",
"3.0.0rc5",
"3.0.0rc4",
"3.0.0rc3",
"prefect-databricks-0.3.0rc2",
"3.0.0rc2",
"prefect-aws-0.5.0rc1",
"prefect-kubernetes-0.4.0rc1",
"prefect-dbt-0.6.0rc1",
"prefect-sqlalchemy-0.5.0rc1",
"prefect-snowflake-0.28.0rc1",
"prefect-shell-0.3.0rc1",
"prefect-ray-0.4.0rc1",
"prefect-gitlab-0.3.0rc1",
"prefect-github-0.3.0rc1",
"prefect-gcp-0.6.0rc1",
"prefect-email-0.4.0rc1",
"prefect-docker-0.6.0rc1",
"prefect-databricks-0.3.0rc1",
"prefect-dask-0.3.0rc1",
"prefect-bitbucket-0.3.0rc1",
"prefect-azure-0.4.0rc1",
"prefect-slack-0.3.0rc1",
"3.0.0rc1",
"2.19.0",
"2.18.3",
"prefect-slack-0.2.5",
"prefect-gcp-0.5.11",
"prefect-databricks-0.2.6",
"2.18.2",
"prefect-sqlalchemy-0.4.2",
"prefect-snowflake-0.27.5",
"prefect-slack-0.2.4",
"prefect-shell-0.2.4",
"prefect-ray-0.3.5",
"prefect-kubernetes-0.3.9",
"prefect-gitlab-0.2.4",
"prefect-github-0.2.4",
"prefect-gcp-0.5.10",
"prefect-email-0.3.4",
"prefect-docker-0.5.1",
"prefect-dbt-0.4.3",
"prefect-databricks-0.2.5",
"prefect-dask-0.2.8",
"prefect-bitbucket-0.2.4",
"prefect-azure-0.3.9",
"prefect-aws-0.4.16",
"prefect-ray-0.3.4",
"2.18.1",
"prefect-sqlalchemy-0.4.1",
"prefect-snowflake-0.27.4",
"prefect-slack-0.2.3",
"prefect-kubernetes-0.3.8",
"prefect-gitlab-0.2.3",
"prefect-github-0.2.3",
"prefect-gcp-0.5.9",
"prefect-email-0.3.3",
"prefect-docker-0.5.0",
"prefect-dbt-0.4.2",
"prefect-databricks-0.2.4",
"prefect-dask-0.2.7",
"prefect-bitbucket-0.2.3",
"prefect-aws-0.4.15",
"prefect-shell-0.2.3",
"prefect-azure-0.3.8",
"2.18.0",
"2.17.1",
"2.17.0",
"2.16.9",
"2.16.8",
"2.16.7",
"2.16.6",
"2.16.5",
"2.16.4",
"2.16.3",
"2.16.2",
"2.16.1",
"2.16.0",
"2.15.0",
"2.14.21",
"2.14.20",
"2.14.19",
"2.14.18",
"2.14.17",
"2.14.16",
"2.14.15",
"2.14.14",
"2.14.13",
"2.14.12",
"2.14.11",
"2.14.10",
"2.14.9",
"2.14.8",
"2.14.7",
"2.14.6",
"2.14.5",
"2.14.4",
"2.14.3",
"2.14.2",
"2.14.1",
"2.14.0",
"2.13.8",
"2.13.7",
"2.13.6",
"2.13.5",
"2.13.4",
"2.13.3",
"2.13.2",
"2.13.1",
"2.13.0",
"2.12.1",
"2.12.0",
"2.11.5",
"2.11.4",
"2.11.3",
"2.11.2",
"2.11.1",
"2.11.0",
"2.10.21",
"2.10.20",
"2.10.19",
"2.10.18",
"2.10.17",
"2.10.16",
"2.10.15",
"2.10.14",
"2.10.13",
"2.10.12",
"2.10.11",
"2.10.10",
"2.10.9",
"2.10.8",
"2.10.7",
"2.10.6",
"2.10.5",
"2.10.4",
"2.10.3",
"2.10.2",
"2.10.1",
"2.10.0",
"2.9.0",
"2.8.7",
"2.8.6",
"2.8.5",
"2.8.4",
"2.8.3",
"2.82",
"2.8.2",
"2.8.1",
"2.8.0",
"2.7.12",
"2.7.11",
"2.7.10",
"2.7.9",
"2.6.9",
"2.7.8",
"2.7.7",
"2.7.5",
"2.7.4",
"2.7.3",
"2.7.2",
"2.7.1",
"2.7.0",
"2.6.8",
"2.6.7",
"2.6.6",
"2.6.5",
"2.6.4",
"2.6.3",
"2.6.2",
"2.6.1",
"2.6.0",
"2.5.0",
"2.4.5",
"2.4.4",
"2.4.3",
"2.4.2",
"2.4.1",
"2.4.0",
"2.3.2",
"2.3.1",
"2.3.0",
"2.2.0",
"2.1.1",
"2.1.0",
"2.0.4",
"2.0.3",
"2.0.2",
"2.0.1",
"2.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72538.json"
}
}
],
"modified": "2026-10-28T02:30:27.149440701Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72538.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-72538",
"https://github.com/PrefectHQ/prefect"
],
"provider_metadata": {
"cwe_ids": [
"CWE-88"
],
"cna_assigner": "TuranSec",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72538.json"
}
},
"related_cves": [
{
"value": "CVE-2026-72538",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493948,
"published_at": "2026-08-11T11:07:35.41+00:00"
}