Authenticated SSRF in Airbyte OneDrive Connector
Airbyte’s OneDrive connector does not validate a URI in _get_shared_drive_object before requesting a resource. A remote attacker with a low-privilege account can trigger the request without user interaction. The request runs as the connector service account and can disclose information available to that account. Affected and fixed versions are not listed.
What to do: Apply Airbyte’s update for CVE-2026-92204. No fixed version is stated.
| Product | Affected |
|---|---|
| Airbyte OneDrive Connector | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.
ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92204, CVSS 7.7) in Airbyte's OneDrive connector, requiring authentication.
Today 341 readers · 368 views · 257 reads · all time 164K views