Live › vulnerability › CVE-2026-92203
Go to dashboardThe Airbyte SharePoint connector does not validate a URI passed to its _get_shared_drive_object method before fetching it. An authenticated attacker can make the Airbyte server send requests to arbitrary URLs and read information returned in the service account context.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| airbyte | vendor | unknown | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.
The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.
This page as .md · .json · in your agent: get_signal("CVE-2026-92203")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.