{"metadata": {"vulnerability": "CVE-2026-5366", "count": 21, "kinds": {"milestone": 4, "sighting": 9, "kev": 0, "other": 8}}, "data": [{"timestamp": "2026-04-01T18:18:27.682Z", "date_only": false, "value": "2026-04-01T18:18:27.682Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / @huntr_ai", "record": "CVE-2026-5366", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-20T17:16:26Z", "date_only": false, "value": "2026-06-20T17:16:26Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7PM4-56H2-5RXR", "record": "GHSA-7PM4-56H2-5RXR", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-06-20T17:16:26.560Z", "date_only": false, "value": "2026-06-20T17:16:26.560", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5366", "record": "FKIE_CVE-2026-5366", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-20T18:31:29Z", "date_only": false, "value": "2026-06-20T18:31:29Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7PM4-56H2-5RXR", "record": "GHSA-7PM4-56H2-5RXR", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-06-20T19:59:27.604Z", "date_only": false, "value": "2026-06-20T19:59:27.604188Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moqngff2oa2u", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "bd724169-559b-48b5-999f-c92ecf092935", "content": "CVE-2026-5366 - Git Argument Injection in prefecthq/prefect\nCVE ID : CVE-2026-5366\n \n Published : June 20, 2026, 4:43 p.m. | 2\u00a0hours, 59\u00a0minutes ago\n \n Description : Prefect version 3.6.23 is vulnerable to remote code execution due to improper handling of user-controlled input...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3moqngff2oa2u"}, {"timestamp": "2026-06-21T00:00:42.065Z", "date_only": false, "value": "2026-06-21T00:00:42.065702Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116785154318795848", "record": "cve-2026-5366", "field": "creation_timestamp", "uuid": "ba7661d4-f981-460b-8e0f-562ecad2c7c5", "content": "CVE-2026-5366 (CRITICAL, CVSS 9.9): prefecthq/prefect 3.6.23 lets users with deployment creation rights inject git flags via commit_sha/directories in GitRepository, enabling remote code exec. Restrict permissions & monitor updates. https://radar.offseq.com/threat/cve-2026-5366-cwe-94-improper-control-of-generatio-ef5838b1259ff631 #OffSeq #CVE20265366 #infosec", "url": "https://infosec.exchange/users/offseq/statuses/116785154318795848"}, {"timestamp": "2026-06-22T17:24:58.249Z", "date_only": false, "value": "2026-06-22T17:24:58.249220Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5366", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-22T17:24:58.249Z", "date_only": false, "value": "2026-06-22T17:24:58.249220Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5366", "record": "FKIE_CVE-2026-5366", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-06-22T17:25:02.152Z", "date_only": false, "value": "2026-06-22T17:25:02.152Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-22T17:25:02.152Z", "date_only": false, "value": "2026-06-22T17:25:02.152Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-5366", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-07-02T07:56:04.149Z", "date_only": false, "value": "2026-07-02T07:56:04.149129Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnklw3gq72y", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "9a7f0178-3a16-444f-a40e-c0bd665ba6a9", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-5366 \u0432 Prefect 3.6.23: \u0443\u0433\u0440\u043e\u0437\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430\n\n\n\nhttps://kripta.biz/posts/B5F13C49-5E41-4B3F-94AF-5338A01CA2F1", "url": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpnklw3gq72y"}, {"timestamp": "2026-07-13T22:00:18.284Z", "date_only": false, "value": "2026-07-13T22:00:18.284346Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/90845", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "d873f20c-be82-4a08-91ae-5aa1ab30287a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a prefect-cve-2026-5366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renat0z3r0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 13:44:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90845"}, {"timestamp": "2026-07-15T00:00:21.484Z", "date_only": false, "value": "2026-07-15T00:00:21.484658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90845", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "745798d8-faac-4629-89e9-8e691669b77e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a prefect-cve-2026-5366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renat0z3r0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 13:44:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90845", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-16T19:00:29.705Z", "date_only": false, "value": "2026-07-16T19:00:29.705642Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ChI_-_yuP3aEKC_gSwO4QBcx90clvJ_NicXYpP6AzBpj5p0", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "7715989d-c843-4399-8814-1d4de24f2dda"}, {"timestamp": "2026-07-16T19:00:29.746Z", "date_only": false, "value": "2026-07-16T19:00:29.746868Z", "kind": "sighting", "label": "Seen", "source": "Telegram/om3YhtaPu5txmcqgS2vE6wxr9r90wWmyuf596mxiJ-5mabI", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "6e472da2-6827-4fa4-a1ad-ecf87c08680f"}, {"timestamp": "2026-07-18T02:00:05.542Z", "date_only": false, "value": "2026-07-18T02:00:05.542108Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/om3YhtaPu5txmcqgS2vE6wxr9r90wWmyuf596mxiJ-5mabI", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "432bddb5-c2f0-4941-a96e-8054f0798795", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-07-18T02:00:05.624Z", "date_only": false, "value": "2026-07-18T02:00:05.624666Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ChI_-_yuP3aEKC_gSwO4QBcx90clvJ_NicXYpP6AzBpj5p0", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "406948c0-6ca2-437a-88ad-4e705b8834b4", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-25T23:10:00.167Z", "date_only": false, "value": "2026-10-25T23:10:00.167", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-5366", "record": "FKIE_CVE-2026-5366", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-03T21:18:13Z", "date_only": false, "value": "2026-11-03T21:18:13Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7PM4-56H2-5RXR", "record": "GHSA-7PM4-56H2-5RXR", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T15:38:23.424Z", "anchors": {"origin": {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-07-15T00:00:21.484Z", "date_only": false, "value": "2026-07-15T00:00:21.484658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90845", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "745798d8-faac-4629-89e9-8e691669b77e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a prefect-cve-2026-5366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renat0z3r0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 13:44:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90845", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 2099804.139, "hours": 583.2789275, "days": 24.303288645833334, "min_seconds": 2099804.139, "max_seconds": 2099804.139, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-07-15T00:00:21.484Z", "date_only": false, "value": "2026-07-15T00:00:21.484658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90845", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "745798d8-faac-4629-89e9-8e691669b77e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a prefect-cve-2026-5366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renat0z3r0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 13:44:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90845", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 11919286.079715, "hours": 3310.9127999208335, "days": 137.9546999967014, "min_seconds": 11919286.079715, "max_seconds": 11919286.079715, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-06-20T16:43:37.345Z", "date_only": false, "value": "2026-06-20T16:43:37.345Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-5366", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T15:38:23.424Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 9819481.940715, "hours": 2727.6338724208335, "days": 113.65141135086806, "min_seconds": 9819481.940715, "max_seconds": 9819481.940715, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-15T00:00:21.484Z", "date_only": false, "value": "2026-07-15T00:00:21.484658Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/90845", "record": "CVE-2026-5366", "field": "creation_timestamp", "uuid": "745798d8-faac-4629-89e9-8e691669b77e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a prefect-cve-2026-5366\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a renat0z3r0\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-27 13:44:05\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-5366: git argument injection in Prefect's GitRepository leading to RCE on the worker.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/90845", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-05T15:38:23.424Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}