Airbyte Connector Builder Vulnerability Actively Exploited for Code Execution (CVE Unassigned, CVSS 9.9)
JPCERT/CC issued an advisory (JVN12040144) on November 4, 2026 confirming active exploitation of a critical flaw in Airbyte's Connector Builder affecting all self-managed Airbyte versions prior to 2.2.0. The vulnerability, rated CVSS 3.1 9.9 by Airbyte, allows attackers to load unintended Python classes via declarative manifests, leading to arbitrary command execution inside the container. Because Airbyte containers frequently hold credentials for connected databases, APIs and warehouses, successful exploitation can expose secrets and provide a pivot point into internal services reachable from the compromised container. The advisory does not identify the threat actor or the scale of exploitation, but confirms in-the-wild attacks are ongoing. Airbyte Cloud customers are not affected and require no action.
Entenda a falha
A vulnerabilidade
Airbyte's Connector Builder (manifest-server) has an unsafe reflection flaw (CWE-470, GHSA-g35w-6r6v-h4r7, no CVE assigned, CVSS 3.1 9.9 per Airbyte) that lets an attacker load unintended Python classes through a declarative manifest and run arbitrary commands inside the container. On Airbyte 2.x an attacker needs Workspace Reader, Organization Reader or higher access; on the legacy 1.x Helm chart anyone with network access can do it, because the service ignored the authorization setting. All self-managed versions before 2.2.0 are affected; the fix is 2.2.0 (manifest-server 7.23.7). Airbyte 1.x gets no fix. Airbyte Cloud is not affected. JPCERT/CC (JVN12040144) confirms exploitation in the wild.
Como funciona
Connector Builder accepts declarative manifests that describe a data connector, and a manifest can reference a custom component by naming a Python class. The manifest-server reads the manifest and resolves that class name to a Python object inside the container. Before 2.2.0 this step had no restriction on which classes could be named, so a user could make the service invoke Python objects already present in the container that were never meant to be used this way. That leads to command execution in the container.
Por que é vulnerável
The root cause is a missing allow-list: the service did not restrict which Python classes a manifest could reference as a custom component, which is unsafe reflection (CWE-470). The protection meant to block custom code, the AIRBYTE_ENABLE_UNSAFE_CODE setting, was bypassed because the flaw worked even when it was disabled. On the 1.x Helm chart the service also ignored the authorization setting. The articles do not describe the code change in the fix beyond shipping manifest-server 7.23.7 in Airbyte 2.2.0.
Onde está
The flaw is in Airbyte's Connector Builder manifest-server (the Manifest Server service), tracked in advisory GHSA-g35w-6r6v-h4r7; the articles name no file or function.
Como foi descoberta
The articles do not say who found the flaw or how it was reported. It became public through the Airbyte security advisory GHSA-g35w-6r6v-h4r7 and a JPCERT/CC advisory (JVN12040144) published on November 4, 2026, which says it has been confirmed exploited in the wild. The advisory does not name the attackers or say how many systems were hit.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:08.
Detalhes técnicos
The flaw, tracked under GHSA-g35w-6r6v-h4r7 and classified as CWE-470 (unsafe reflection), stems from Connector Builder's manifest-server failing to restrict which Python classes a declarative manifest could reference as a custom component. This bypassed protections even when the AIRBYTE_ENABLE_UNSAFE_CODE setting was disabled. On Airbyte 2.x before 2.2.0, any user with Workspace Reader, Organization Reader, or higher access could exploit the flaw. On the legacy Airbyte 1.x Helm chart, anyone with network access could exploit it because the service ignored the authorization setting entirely.
Remediação
Organizations should upgrade self-managed Airbyte deployments to version 2.2.0 or later, which ships manifest-server 7.23.7. Airbyte 1.x will not receive a fix and should be migrated off. Where immediate patching is not possible, restrict network access so only the Airbyte server can reach the Connector Builder/Manifest Server service, and limit Workspace Reader and Organization Reader roles to trusted users. Given confirmed exploitation, defenders should also review container logs for signs of compromise and rotate all credentials and secrets stored within affected containers.
Linha do tempo
-
Airbyte Connector Builder Vulnerability Actively Exploited for Code Execution (CVE Unassigned, CVSS 9.9)
ler a análise desta fonte ocultar
JPCERT/CC issued an advisory (JVN12040144) on November 4, 2026 confirming active exploitation of a critical flaw in Airbyte's Connector Builder affecting all self-managed Airbyte versions prior to 2.2.0. The vulnerability, rated CVSS 3.1 9.9 by Airbyte, allows attackers to load unintended Python classes via declarative manifests, leading to arbitrary command execution inside the container. Because Airbyte containers frequently hold credentials for connected databases, APIs and warehouses, successful exploitation can expose secrets and provide a pivot point into internal services reachable from the compromised container. The advisory does not identify the threat actor or the scale of exploitation, but confirms in-the-wild attacks are ongoing. Airbyte Cloud customers are not affected and require no action.
Technical Details
The flaw, tracked under GHSA-g35w-6r6v-h4r7 and classified as CWE-470 (unsafe reflection), stems from Connector Builder's manifest-server failing to restrict which Python classes a declarative manifest could reference as a custom component. This bypassed protections even when the
AIRBYTE_ENABLE_UNSAFE_CODEsetting was disabled. On Airbyte 2.x before 2.2.0, any user with Workspace Reader, Organization Reader, or higher access could exploit the flaw. On the legacy Airbyte 1.x Helm chart, anyone with network access could exploit it because the service ignored the authorization setting entirely.Remediation
Organizations should upgrade self-managed Airbyte deployments to version 2.2.0 or later, which ships manifest-server 7.23.7. Airbyte 1.x will not receive a fix and should be migrated off. Where immediate patching is not possible, restrict network access so only the Airbyte server can reach the Connector Builder/Manifest Server service, and limit Workspace Reader and Organization Reader roles to trusted users. Given confirmed exploitation, defenders should also review container logs for signs of compromise and rotate all credentials and secrets stored within affected containers.