PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-92204 Airbyte CVE debrief

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account.

Vendor
Airbyte
Product
Unknown
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-30
Advisory published
2026-10-21
Advisory updated
2026-10-30

Who should care

Defenders responsible for Airbyte installations, especially those using version 1.8, should assess the potential impact of this vulnerability and prioritize verification and remediation efforts.

Why it matters

This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte, potentially leading to information disclosure. Defenders should prioritize verifying the vulnerability in their Airbyte installations, especially if they are using version 1.8, and assess the potential impact of information disclosure.

  • Information disclosure in the context of the service account
  • Potential for unauthorized access to sensitive information
  • Need for proper validation of URIs prior to accessing resources
  • Verification of Airbyte installations for vulnerability

Technical summary

The vulnerability exists within the _get_shared_drive_object method due to the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte, potentially leading to information disclosure. Defenders should prioritize verifying the vulnerability in their Airbyte installations, especially if they are using version 1.8, and assess the potential impact of information disclosure.

Defensive priority

Defenders should prioritize verifying the vulnerability in their Airbyte installations, especially if they are using version 1.8, and assess the potential impact of information disclosure.

Recommended defensive actions

  • Verify Airbyte installations for vulnerability, especially version 1.8
  • Assess potential impact of information disclosure
  • Implement proper validation of URIs prior to accessing resources
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability exists within the _get_shared_drive_object method due to the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-92204 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-92204

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-92204 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-92204

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.