Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder
Do Son 
TL;DR
On November 4, 2026, Japan’s JPCERT/CC warned about an Airbyte vulnerability that allows arbitrary code execution. The flaw “has been confirmed to be exploited in the wild.” The flaw affects all Airbyte versions before 2.2.0. Airbyte itself rates the bug critical, with a CVSS 3.1 score of 9.9.
Airbyte’s Connector Builder let users load unintended Python classes, which can lead to command execution in the container. Attackers are already exploiting this Airbyte vulnerability. Upgrade self-managed deployments to Airbyte 2.2.0 now.
Why It Matters
Airbyte moves data between databases, APIs and warehouses. As a result, its containers often hold credentials for many systems. According to Airbyte, successful exploitation “may expose data, credentials and secrets available to the affected container.” It “may allow access to internal services reachable from it” as well.
The JVN advisory JVN12040144 confirms active exploitation. However, it does not say who is behind the attacks or how many systems were hit. Airbyte Cloud customers “do not need to take any action,” the vendor says.
How the Attack Works
Connector Builder accepts declarative manifests that describe a data connector. Before 2.2.0, the service “did not restrict which Python classes a declarative manifest could reference as a custom component.” So a user could make the service invoke unintended Python objects already in the container. JPCERT/CC classifies this as unsafe reflection (CWE-470).
Notably, this worked “even when AIRBYTE_ENABLE_UNSAFE_CODE was not enabled.” That setting was meant to block custom code.
Who can exploit it
- Airbyte 2.x before 2.2.0: any user with Workspace Reader or Organization Reader access, or higher.
- Airbyte 1.x on the legacy Helm chart: anyone with network access, since the service ignored the auth setting.
Affected Versions
All Airbyte versions prior to 2.2.0 are affected. Airbyte 1.x will not receive a fix.
Patch and Mitigation
Upgrade to Airbyte 2.2.0 or later, which ships manifest-server 7.23.7. The Airbyte 2.2 release notes cover the upgrade. If you cannot patch yet, Airbyte suggests two steps:
- Allow only the Airbyte server to reach the Connector Builder or Manifest Server service.
- Limit Workspace Reader and Organization Reader roles to trusted users.
Details are in the Airbyte security advisory GHSA-g35w-6r6v-h4r7. Since this Airbyte vulnerability is exploited in the wild, also review container logs and rotate stored credentials.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
