{"id":"CVE-2026-92203","kind":"vulnerability","aliases":["CVE-2026-92203"],"related":[],"title":"Airbyte SharePoint connector: authenticated SSRF leaks data via shared drive lookup","description":"Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28215.","summary":"The Airbyte SharePoint connector does not validate a URI passed to its _get_shared_drive_object method before fetching it. An authenticated attacker can make the Airbyte server send requests to arbitrary URLs and read information returned in the service account context.","severity":"high","cvss":7.7,"epss":0.00406,"exploited":false,"exploited_at":null,"products":[{"name":"airbyte","fixed":[],"affected":"unknown","ecosystem":"vendor"}],"ecosystems":[],"tags":["airbyte","authenticated","package","self-hosted","sharepoint-connector","ssrf"],"not_affected_if":["auth-required","no-sharepoint-connector","no-untrusted-users"],"how_to_check":"Check whether any Airbyte connection/source uses the SharePoint connector (source-microsoft-sharepoint) in your workspaces, and which users can create or edit sources. Version range unknown.","fix":"No fixed version published as of 2026-10-25; ZDI says only mitigation is to restrict interaction with the product. Unknown: watch airbytehq/airbyte security advisories and source-sharepoint-enterprise release notes.","status":"open","published_at":"2026-10-21T18:17:30+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:10:29+00:00","updated_at":"2026-10-25T03:47:17+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:10:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Airbyte SharePoint connector: authenticated SSRF leaks data via shared drive lookup","impact":"medium","summary":"The Airbyte SharePoint connector does not validate a URI passed to its _get_shared_drive_object method before fetching it. An authenticated attacker can make the Airbyte server send requests to arbitrary URLs and read information returned in the service account context.","category":"package","nicknames":[],"who_cares":["airbyte","sharepoint-connector","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads internal responses via server-side requests using the service account","analyst_note":"Check the NVD entry and the Airbyte advisory for affected versions, the fixed release, and whether the SharePoint connector is affected in default configuration.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000534,"input_tokens":3465,"output_tokens":375,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Airbyte advisory for affected versions, the fixed release, and whether the SharePoint connector is affected in default configuration.","search":"'-2026':13A,16A '-26':19A '-703':20A '-92203':14A,17A '28215':163C 'access':141C 'account':72B,158C 'affect':102C 'airbyt':1A,22B,33B,58B,74C,105C 'airbyte':21A 'allow':91C 'arbitrari':63B,96C 'attack':54B,93C,144C 'authent':4A,23B,53B,106C 'connector':3A,30B,35B,76C 'context':73B,154C 'cve':12A,15A 'data':7A 'disclos':150C 'disclosur':87C 'drive':10A,46B,79C,124C 'exist':116C 'exploit':110C 'fetch':50B 'flaw':115C 'forgeri':85C 'get':44B,77C,122C 'host':27B 'implement':119C 'inform':67B,86C,151C 'initi':95C 'instal':103C 'issu':128C 'lack':132C 'leak':6A 'leverag':146C 'lookup':11A 'make':56B 'method':48B,126C 'object':47B,80C,125C 'packag':24B 'pass':41B 'prior':139C 'proper':134C 'read':66B 'remot':92C 'request':61B,84C,100C 'requir':108C 'resourc':142C 'result':129C 'return':68B 'self':26B 'self-host':25B 'send':60B 'server':59B,82C,98C 'server-sid':81C,97C 'servic':71B,157C 'share':9A,45B,78C,123C 'sharepoint':2A,29B,34B,75C 'sharepoint-connector':28B 'side':83C,99C 'specif':114C 'ssrf':5A,31B 'uri':40B,138C 'url':64B 'valid':38B,135C 'via':8A 'vulner':88C,90C,112C,148C 'within':117C 'zdi':18A,161C 'zdi-can':160C","nicknames":["ZDI-26-703"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T18:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvss_by":"zdi-disclosures@trendmicro.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92203","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92203","severity":null,"published_at":"2026-10-21T18:17:30+00:00","modified_at":"2026-10-22T17:34:37+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-92203","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92203","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92203:696","url":null,"severity":null,"published_at":"2026-10-25T03:19:31+00:00","modified_at":"2026-10-25T03:19:31+00:00","first_seen_at":"2026-10-25T03:19:31+00:00","fetched_at":"2026-10-25T03:19:31+00:00","note":"ZDI-26-703 0-day (reported 2025-10-29, published 2026-09-16, CVSS 7.7); no Airbyte advisory, affected/fixed versions not published (checked ZDI, Rapid7, GH advisory list). Sibling: CVE-2026-92204 OneDrive connector. No exploitation/PoC known. Nothing marked verified."}],"documents":[{"id":3117,"url":"https://www.zerodayinitiative.com/advisories/ZDI-26-703/","title":"ZDI-26-703 Airbyte SharePoint Connector _get_shared_drive_object SSRF (0-day)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3118,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-92203/","title":"Rapid7 CVE-2026-92203","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}