Live › vulnerability › CVE-2026-92204
Go to dashboardThe Airbyte OneDrive connector does not validate a URI in _get_shared_drive_object before fetching it. An authenticated remote user can make the server issue requests to arbitrary destinations and disclose information visible to the connector's service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Airbyte with the OneDrive source connector configured, where users can create or edit connections. Deployments without the OneDrive connector, or with no untrusted users on the Airbyte instance, have less exposure. The sources do not state which Airbyte versions are vulnerable.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.
The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.
This page as .md · .json · in your agent: get_signal("CVE-2026-92204")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.