ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

Airbyte

2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

ZDI-26-704: (0Day) Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92204, CVSS 7.7) in Airbyte's OneDrive connector, requiring authentication.

ZDI-26-704 describes a server-side request forgery vulnerability in the _get_shared_drive_object function of Airbyte's OneDrive connector. Remote authenticated attackers can initiate arbitrary server-side requests leading to information disclosure. The flaw scores CVSS 7.7, is tracked as CVE-2026-92204, and is published as a 0day advisory without a referenced fix.

ZDI Published Advisories · 18h agoVulnerability 2 sourcesCVE-2026-92204

ZDI-26-703: (0Day) Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability

ZDI disclosed an unpatched SSRF information disclosure flaw (CVE-2026-92203, CVSS 7.7) in Airbyte's SharePoint connector, exploitable by authenticated remote users.

The Zero Day Initiative published ZDI-26-703 describing a server-side request forgery vulnerability in the _get_shared_drive_object function of Airbyte's SharePoint connector. Remote attackers can initiate arbitrary server-side requests to disclose information, though valid authentication credentials are required. The flaw carries a CVSS score of 7.7 and is tracked as CVE-2026-92203; it is flagged as a 0day with no vendor patch referenced.

ZDI Published Advisories · 18h agoVulnerability 2 sourcesCVE-2026-92203

Related CVEs

Appears with

organization Zero Day Initiative 2vendor Zero Day Initiative 2product Airbyte OneDrive Connector 1product Airbyte SharePoint Connector 1product OneDrive 1vendor Microsoft 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.