Airbyte Connector Builder flaw allows code execution, JVN reports attacks

Airbyte Connector Builder flaw allows code execution, JVN reports attacks

10 November 2026: Airbyte versions before 2.2.0 let a logged-in user run commands on the server through Connector Builder custom components, a critical flaw (GHSA-g35w-6r6v-h4r7, CVSS 9.9) that Japan's vulnerability service JVN now says is being exploited. Version 2.2.0 fixes it, Airbyte Cloud customers have nothing to do, and the older 1.x line will not be patched.

Not yet independently verified. Only JVN states that exploitation has been confirmed. Airbyte's advisory does not mention it, the flaw is not in CISA's catalogue at its 9 November update, and no CVE number appears in the advisory. We will update this when it can be confirmed, and remove this note.

How a test read becomes a shell

Connector Builder and the Manifest Server did not restrict which Python classes a declarative manifest could name as a custom component. A user submitting a manifest for a test read could therefore load Python objects already present in the container and call them to run arbitrary commands. The project's advisory is titled for the case where unsafe code is disabled, so the setting administrators relied on did not stop it.

What an attacker needs depends on the version. On Airbyte 2.x before 2.2.0, a user with Workspace Reader or Organization Reader access or above is enough. On Airbyte 1.x installed through the legacy Helm chart, the Connector Builder service did not inherit global.auth.enabled, so any client that could reach the service over the network could exploit it with no account at all.

Why a data pipeline makes a rich target

A data integration tool holds connection details for the databases and SaaS applications it copies from. Airbyte says successful exploitation may expose data, credentials and secrets held in the Manifest Server container and open a path to internal services that container can reach. Any credential stored there should be treated as exposed on a server that was reachable while unpatched.

JVN#12040144 was issued on 4 November and updated on 10 November by JPCERT/CC and IPA, and it rates the matter urgent, with CVSS 4.0 at 8.7 and CVSS 3.0 at 8.8. That is lower than the 9.9 in Airbyte's own advisory of 17 October, and neither body explains the gap. JVN credits a report through the IPA early warning partnership by an employee of ZOZO, Inc.

An upgrade that only goes one way

Version 2.2 came out on 10 August 2026, so the fix has existed for three months and the exposed group is everyone who did not take it. The upgrade needs some care:

• The 2.2.0 migrations drop tables that 2.1.x depends on, so the move cannot be rolled back without a database backup.
• Self-Managed Enterprise customers are told not to upgrade on their own and to speak to their Airbyte representative first.
• After 2.2.0, custom components in manifests sent through Connector Builder are refused unless AIRBYTE_ENABLE_UNSAFE_CODE=true, so that variable should stay unset unless every workspace user is trusted.

If the upgrade has to wait

Airbyte's workarounds are to restrict network access to Connector Builder and the Manifest Server so that only the Airbyte server can reach them, and to limit Workspace Reader and Organization Reader roles to trusted people. Instances still on 1.x have no patch coming and need to move to 2.2.0 or later. Rival tool Fivetran sits in our big data and BI category of 856 companies, and our ETL software category lists 15 products.

Company profile on TrustList: Airbyte

Sources

• Airbyte security advisory GHSA-g35w-6r6v-h4r7, 17 October 2026
• JVN#12040144 (JPCERT/CC and IPA), updated 10 November 2026, 4 November 2026
• Airbyte 2.2 self-managed release notes, 10 August 2026