Prefect vulnerabilities

2 known vulnerabilities in Prefect from PrefectHQ. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Prefect: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-72538Aug 11, 2026PrefectHQ

  An argument injection vulnerability in PrefectHQ Prefect through 3.8.2 allows authenticated users to achieve remote code execution via the git_clone pull step branch field. The branch parameter is passed directly to git pull without sanitization, enabling inje

• 7.3 High severity

  prefect: Improper Authentication

  CVE-2026-7723May 4, 2026PrefectHQ

  A flaw has been found in PrefectHQ prefect up to 3.6.13. Affected is an unknown function of the file /api/events/in of the component WebSocket Endpoint. Executing a manipulation can lead to missing authentication. The attack may be performed from remote. The e