Read the docs
TI-2026-78893 Aliases CVE-2026-92203GHSA-qvf2-fq2x-c529

Server-side request forgery in Airbyte SharePoint connector

Priority LOW 34CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Airbyte from 1.8 contains a server-side request forgery flaw (CWE-918) in the SharePoint connector's _get_shared_drive_object method. The method does not validate a URI before accessing resources. An authenticated remote attacker can make arbitrary server-side requests and disclose information in the context of the service account.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Description from the CNA

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00406 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AirbyteAirbyte1.8—No fix listedCNA
  • Airbyte VendorAirbyte Affected 1.8 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Airbyte.

Written with Claude Haiku 5.5 from the sources below · 2026-10-30

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-92203
  2. 2026-10-21 Alias added: GHSA-qvf2-fq2x-c529
  3. 2026-10-23 Priority changed: MEDIUM → LOW
  4. 2026-10-30 CISA SSVC decision points changed

References

Other 1

  • TI-2026-78894 Server-side request forgery in Airbyte OneDrive connector CVSS 3.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences