{"slug":"airbyte-connector-builder-rce","title":"Airbyte Connector Builder / Manifest Server RCE (GHSA-g35w-6r6v-h4r7, JVN#12040144)","shortName":"Airbyte Builder","seoTitle":"Airbyte Builder: affected versions, exploitation & detection","summary":"Unsafe reflection (CWE-470) in Airbyte self-managed Connector Builder / Manifest Server (GHSA-g35w-6r6v-h4r7, JVN#12040144; scores differ: GHSA CVSS 3.1 9.9 vs JVN CVSS 3.0 8.8). No CVE assigned. A declarative manifest could name any Python class already in the container as a custom component, and the service would invoke it, even with AIRBYTE_ENABLE_UNSAFE_CODE disabled. GHSA-g35w-6r6v-h4r7 scores it CVSS 3.1 9.9 Critical (scope changed). JVN#12040144 scores it CVSS 3.0 8.8 (scope unchanged) and CVSS 4.0 8.7. Those scores disagree; this page shows both dated. Airbyte Cloud customers need no action. Badge: Reported exploited (JPCERT/CC, 4 Nov 2026). Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026). No public PoC indexed. Fixed in 2.2.0 (manifest-server 7.23.7 / airbyte-cdk 7.23.7). 1.x has no fix.","isExample":false,"draft":false,"family":"airbyte-connector-builder-rce","kind":"single-product","aliases":["GHSA-g35w-6r6v-h4r7","JVN#12040144","JVN12040144","Airbyte Connector Builder RCE","Airbyte Manifest Server RCE"],"publishedAt":"2026-11-05","updatedAt":"2026-11-05","patchStatus":"patched","exploited":"reported","scores":{"cvss":null,"epss":{"score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss","checkedDate":"2026-11-05"},"kev":{"listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.11.04","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-11-05"},"addedDate":"2026-11-05"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unsafe reflection in Airbyte self-managed Connector Builder / Manifest Server (GHSA-g35w-6r6v-h4r7, JVN#12040144). No CVE assigned. A submitted manifest can make the service invoke an installed Python class, even with AIRBYTE_ENABLE_UNSAFE_CODE disabled. GHSA-g35w-6r6v-h4r7 scores it CVSS 3.1 9.9 Critical (scope changed). JVN#12040144 scores it CVSS 3.0 8.8 (scope unchanged) and CVSS 4.0 8.7. Reported exploited (JPCERT/CC, 4 Nov 2026). Not in CISA KEV (checked 5 Nov 2026). Airbyte Cloud customers need no action.","action":"Upgrade self-managed Airbyte to 2.2.0 or later. Until then, allow only the Airbyte server to reach Connector Builder / Manifest Server, and limit Reader roles to trusted users. Because exploitation is reported, review those container logs and rotate credentials stored in or reachable from Airbyte."},"seenInTheWild":[{"metric":"third-party-stated","value":"JVN#12040144 reports in-the-wild use; no actor, victim count, or IOCs","observer":"JPCERT/CC","date":"2026-11-04","method":"JVN#12040144 (published 4 Nov 2026, last updated 4 Nov 2026) writes that the vulnerability has been confirmed to be exploited in the wild. Airbyte has not stated exploitation. No actor, victim count, or IOCs. Badge: Reported exploited. Do not treat this as vendor-verified ITW.","sourceUrl":"https://jvn.jp/en/jp/JVN12040144/index.html"}],"seenInTheWildLinks":[{"title":"JVN#12040144: Airbyte vulnerable to arbitrary code execution","url":"https://jvn.jp/en/jp/JVN12040144/index.html","observer":"JPCERT/CC","metric":"third-party-stated"}],"whatChanged":{"date":"2026-11-05","items":[{"text":"New catalog page for Airbyte Connector Builder / Manifest Server RCE (GHSA-g35w-6r6v-h4r7, JVN#12040144). No CVE assigned.","headline":"New catalog page for Airbyte Connector Builder RCE","section":"overview","date":"2026-11-05","kind":"page"},{"text":"Airbyte published GHSA-g35w-6r6v-h4r7 on 17 Oct 2026. Unsafe reflection (CWE-470) in Connector Builder / Manifest Server. Affected: all self-managed versions before 2.2.0. Fixed: 2.2.0, which ships manifest-server 7.23.7 and airbyte-cdk 7.23.7. 1.x gets no fix; upgrade to 2.2.0. Airbyte Cloud customers need no action. GHSA-g35w-6r6v-h4r7 scores it CVSS 3.1 9.9 Critical (scope changed, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). JVN#12040144 scores it CVSS 3.0 8.8 (scope unchanged) and CVSS 4.0 8.7. No official CVSS is stored here because no CVE is assigned.","headline":"Airbyte 2.2.0 is the fix; 1.x has none; Cloud needs no action","section":"fixed-versions","date":"2026-11-05","sourceUrl":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","alsoSourceUrl":"https://docs.airbyte.com/release_notes/self-managed/v-2.2"},{"text":"JVN#12040144 (JPCERT/CC, 4 Nov 2026) reports in-the-wild use, with no actor, victim count, or IOCs. Airbyte has not stated exploitation. Badge: Reported exploited. Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026). No public PoC indexed as of 5 Nov 2026.","headline":"Reported exploited via JVN; not in KEV; no public PoC","section":"exploitation","date":"2026-11-05","sourceUrl":"https://jvn.jp/en/jp/JVN12040144/index.html","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},"whatTheBugIs":"GHSA-g35w-6r6v-h4r7 (published 17 Oct 2026) and JVN#12040144 (4 Nov 2026) describe unsafe reflection (CWE-470) in Airbyte self-managed Connector Builder / Manifest Server. No CVE is assigned as of 5 Nov 2026. Do not invent one. Identifiers on this page are GHSA-g35w-6r6v-h4r7 and JVN#12040144.\n\nGHSA: in versions before 2.2.0 the Connector Builder and Manifest Server did not restrict which Python classes a declarative manifest could reference as a custom component. A user able to submit a manifest for a Connector Builder test read could cause the service to load and invoke unintended Python objects already installed in the container. That gives command execution inside the Connector Builder or Manifest Server container, even when AIRBYTE_ENABLE_UNSAFE_CODE was not enabled. This page does not name classes, payloads, or reproduction steps.\n\nPreconditions, from the GHSA. Airbyte 2.x before 2.2.0: an authenticated Workspace Reader or Organization Reader, or higher. Airbyte 1.x: all deployments are affected and have no fix; upgrade to 2.2.0. On the 1.x legacy Helm chart, the Connector Builder service did not inherit global.auth.enabled, so no authentication was required. GHSA also lists CWE-306 for that missing-auth case.\n\nScope: self-managed Airbyte only. GHSA: Airbyte Cloud customers do not need to take any action. Successful use may expose data, credentials and secrets available to the affected container, and may allow access to internal services reachable from it.\n\nSeverity scores disagree, and this page keeps each dated. GHSA-g35w-6r6v-h4r7 scores it CVSS 3.1 9.9 Critical (scope changed, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). JVN#12040144 scores it CVSS 3.0 8.8 (scope unchanged, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). No official CVSS record is stored in the priority block because no CVE is assigned. FIRST EPSS has no row to query without a CVE (checked 5 Nov 2026).\n\nFix: Airbyte 2.2.0, which ships manifest-server 7.23.7 and airbyte-cdk 7.23.7. Airbyte 2.2 release notes date that release to 10 Aug 2026 and name manifest-server image tag 7.23.7. The CDK fix landed in airbyte-python-cdk pull request 1076 (merged 22 Jul 2026). GHSA: custom components in manifests submitted through Connector Builder are now rejected unless AIRBYTE_ENABLE_UNSAFE_CODE=true. Airbyte 1.x will not receive a fix; upgrade to 2.2.0 or later.\n\nExploitation: JVN#12040144 (JPCERT/CC, 4 Nov 2026) writes that the vulnerability has been confirmed to be exploited in the wild. It names no actor, victim count, or IOCs. Airbyte has not stated exploitation. A government CERT statement the vendor has not confirmed is Reported exploited, not a vendor-verified mark. Not in CISA KEV (catalog 2026.11.04, checked 5 Nov 2026). No public PoC indexed as of 5 Nov 2026.\n\nCredit: GitHub user schecthellraiser606 (GHSA reporter). JVN credits Takeyasu Hyodo of ZOZO, Inc., with JPCERT/CC coordinating.","attackPath":{"caption":"High-level only. Not a reproduction guide. No class names, payloads, or manifest examples.","steps":[{"id":"reach","label":"Submit a manifest","detail":"A user who can submit a Connector Builder manifest. 2.x: Workspace Reader or Organization Reader or higher. 1.x on the legacy Helm chart: network access, because the service ignored global.auth.enabled."},{"id":"app","label":"Custom component named","detail":"The manifest names an installed Python class as a custom component. Conceptual impact class only. No class names here."},{"id":"unsafe","label":"Manifest Server invokes it","detail":"Connector Builder / Manifest Server loads and invokes that class (CWE-470), even with AIRBYTE_ENABLE_UNSAFE_CODE disabled."},{"id":"exec","label":"Code in the container","detail":"Command execution inside the Connector Builder or Manifest Server container."},{"id":"shell","label":"Connector credentials","detail":"GHSA: successful use may expose data, credentials and secrets available to that container, and may reach internal services from it."}]},"exploitation":{"kev":{"listed":false,"date":"2026-11-04","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 5 Nov 2026) against catalog 2026.11.04. No CVE is assigned, so there is no CVE row to list."},"firstSeen":{"date":"2026-11-04","source":"JPCERT/CC","note":"Reported exploited (JPCERT/CC, JVN#12040144, 4 Nov 2026). JVN writes that the vulnerability has been confirmed to be exploited in the wild. No actor, victim count, or IOCs. Airbyte has not stated exploitation. Badge: Reported exploited. Do not treat this as vendor-verified ITW."},"vendorStatements":[{"vendor":"JPCERT/CC","date":"2026-11-04","statement":"Note that the vulnerability has been confirmed to be exploited in the wild.","url":"https://jvn.jp/en/jp/JVN12040144/index.html","retracted":false}]},"timeline":[{"date":"2026-07-22","event":"airbyte-python-cdk pull request 1076 merged. GHSA later names this as the CDK fix that ships in 7.23.7. This page links the PR only and does not copy implementation detail.","source":{"title":"airbyte-python-cdk pull request 1076","url":"https://github.com/airbytehq/airbyte-python-cdk/pull/1076","publisher":"Airbyte"},"kind":"patch","key":true,"addedDate":"2026-11-05"},{"date":"2026-08-10","event":"Airbyte 2.2.0 released. Release notes name manifest-server image tag 7.23.7. GHSA later names 2.2.0, with manifest-server 7.23.7 and airbyte-cdk 7.23.7, as the fix.","source":{"title":"Airbyte 2.2 release notes","url":"https://docs.airbyte.com/release_notes/self-managed/v-2.2","publisher":"Airbyte"},"kind":"patch","key":true,"addedDate":"2026-11-05"},{"date":"2026-10-17","event":"Airbyte published GHSA-g35w-6r6v-h4r7. Affected: Airbyte before 2.2.0. Fixed: 2.2.0. Cloud customers need no action. 1.x gets no fix. Credit: schecthellraiser606. No CVE assigned.","source":{"title":"GHSA-g35w-6r6v-h4r7","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","publisher":"Airbyte"},"kind":"advisory","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-04","event":"JVN#12040144 published. JPCERT/CC reports in-the-wild use, with no actor, victim count, or IOCs. Credit: Takeyasu Hyodo of ZOZO, Inc.; JPCERT/CC coordinating. Badge: Reported exploited.","source":{"title":"JVN#12040144: Airbyte vulnerable to arbitrary code execution","url":"https://jvn.jp/en/jp/JVN12040144/index.html","publisher":"JPCERT/CC"},"kind":"reported","key":true,"addedDate":"2026-11-05"},{"date":"2026-11-04","event":"SecurityOnline reports the JPCERT/CC warning. Daily Security Review and Upwind published the same day.","source":{"title":"Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder","url":"https://securityonline.info/airbyte-vulnerability-exploited/","publisher":"SecurityOnline"},"kind":"other","addedDate":"2026-11-05"},{"date":"2026-11-04","event":"Not in CISA KEV. Catalog 2026.11.04. Rechecked 5 Nov 2026. No CVE is assigned, so there is no CVE row to list.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"other","key":true,"addedDate":"2026-11-05"}],"openNotes":[{"title":"No CVE assigned as of 5 Nov 2026","detail":"GHSA-g35w-6r6v-h4r7 does not name a CVE. JVN#12040144 does not name a CVE. Identifiers on this page are those two IDs. There is no official CVSS record to store against a CVE, and FIRST EPSS has no row to query.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"},{"url":"https://jvn.jp/en/jp/JVN12040144/index.html","date":"2026-11-04","publisher":"JPCERT/CC"}]},{"title":"Severity scores disagree","detail":"GHSA-g35w-6r6v-h4r7 scores it CVSS 3.1 9.9 Critical (scope changed, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). JVN#12040144 scores it CVSS 3.0 8.8 (scope unchanged, CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and CVSS 4.0 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N). This page shows both dated and does not pick a winner.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"},{"url":"https://jvn.jp/en/jp/JVN12040144/index.html","date":"2026-11-04","publisher":"JPCERT/CC"}]},{"title":"Reported exploitation has no actor, count, or IOCs","detail":"JVN#12040144 reports in-the-wild use and names no actor, victim count, or IOCs. Airbyte has not stated exploitation. This page does not invent indicators.","sources":[{"url":"https://jvn.jp/en/jp/JVN12040144/index.html","date":"2026-11-04","publisher":"JPCERT/CC"}]}],"defenderActions":[{"title":"Upgrade self-managed Airbyte to 2.2.0 or later","detail":"GHSA: fixed in 2.2.0, which ships manifest-server 7.23.7 and airbyte-cdk 7.23.7. 1.x gets no fix; upgrade to 2.2.0. Airbyte Cloud customers need no action.","priority":"now","links":[{"label":"GHSA-g35w-6r6v-h4r7","href":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7"},{"label":"Airbyte 2.2 release notes","href":"https://docs.airbyte.com/release_notes/self-managed/v-2.2"}]},{"title":"Allow only the Airbyte server to reach Connector Builder / Manifest Server","detail":"GHSA workaround until you can upgrade: restrict network access so that only the Airbyte server can reach the Connector Builder / Manifest Server service.","priority":"now","links":[{"label":"GHSA-g35w-6r6v-h4r7","href":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7"}]},{"title":"Limit Reader roles to trusted users","detail":"GHSA workaround: limit Workspace Reader and Organization Reader access to trusted users. 2.x before 2.2.0 needs one of those roles or higher.","priority":"now","links":[{"label":"GHSA-g35w-6r6v-h4r7","href":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7"}]},{"title":"Review Connector Builder / Manifest Server container logs","detail":"Because exploitation is reported, review those container logs for manifest test-reads that reference custom components. A log hit is a lead, not proof.","priority":"now","links":[{"label":"JVN#12040144","href":"https://jvn.jp/en/jp/JVN12040144/index.html"}]},{"title":"Rotate credentials stored in or reachable from Airbyte","detail":"GHSA: successful use may expose data, credentials and secrets available to the affected container. Because exploitation is reported, rotate those credentials.","priority":"now","links":[{"label":"GHSA-g35w-6r6v-h4r7","href":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7"}]}],"detection":[{"title":"Connector Builder / Manifest Server container logs","detail":"Hunt manifest test-reads that reference custom components. A hit is a lead for a submitted manifest, not proof of code execution. Do not invent a query from the advisory.","logSource":"Connector Builder / Manifest Server container logs","kind":"generic","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17"},{"title":"Unexpected child processes of the manifest-server Python process","detail":"GHSA: successful use runs commands in the Manifest Server container. Hunt unexpected children of that Python process. A child process is a lead, not proof of this bug.","logSource":"Process telemetry for the manifest-server Python process","kind":"generic","group":"edr","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17"},{"title":"Egress from the Manifest Server container","detail":"GHSA: successful use may allow access to internal services reachable from the container. Hunt unexpected egress from that container. Egress is a lead, not proof.","logSource":"Container or host network telemetry for Manifest Server egress","kind":"generic","group":"web-proxy","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17"},{"title":"No public Nuclei, Sigma, or vendor signature","detail":"None public as of 5 Nov 2026. Do not invent a rule from the advisory. Use the log-source pointers above. No compensating-control signatures are known.","logSource":"Public rule indexes (Nuclei, Sigma) and vendor signature bulletins","kind":"generic","date":"2026-11-05","dateKind":"checked"}],"detectionRules":[],"detectionLinks":[],"amIAffected":{"summary":"Self-managed Airbyte before 2.2.0 is in scope. 2.x needs a Workspace Reader or Organization Reader or higher. 1.x is affected on all deployments and has no fix; upgrade to 2.2.0. On the 1.x legacy Helm chart, no authentication was required, because the service did not inherit global.auth.enabled. Airbyte Cloud customers need no action. CVE-keyed scanners will not flag this bug.","checks":[{"id":"v2s-aia-airbyte-connector-builder-rce-version-1","kind":"version","title":"Record the installed Airbyte version","detail":"Compare the product version from the UI or your Helm release to 2.2.0. This is inventory only. Do not submit a test manifest.","command":"Record the Airbyte version shown in the product UI, or the Helm release chart / appVersion, and compare it to 2.2.0.","affectedMeans":"Self-managed Airbyte is below 2.2.0, including any 1.x install.","fixedMeans":"Self-managed Airbyte is 2.2.0 or later, or the estate only uses Airbyte Cloud.","notes":"1.x has no fix on that line. Upgrade to 2.2.0. Airbyte Cloud customers need no action.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]},{"id":"v2s-aia-airbyte-connector-builder-rce-package-2","kind":"package","title":"Record Helm releases and the manifest-server image tag","detail":"GHSA: 2.2.0 ships manifest-server 7.23.7. Inventory Helm releases and image tags. Do not send application requests.","command":"helm list -A | grep -i airbyte","affectedMeans":"A self-managed release is below 2.2.0, or the bundled manifest-server image is older than 7.23.7.","fixedMeans":"The release is 2.2.0 or later and the bundled manifest-server image is 7.23.7 or later, or Airbyte is not installed.","notes":"Release notes also name manifest-server tag 7.23.7. Image names vary by chart. Record the tag you actually run.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"},{"url":"https://docs.airbyte.com/release_notes/self-managed/v-2.2","date":"2026-08-10","publisher":"Airbyte"}]},{"id":"v2s-aia-airbyte-connector-builder-rce-config-3","kind":"config","title":"Record who can reach Connector Builder / Manifest Server, and who holds Reader roles","detail":"2.x: Workspace Reader or Organization Reader or higher. 1.x legacy Helm chart: the service ignored global.auth.enabled. Record network reachability and those roles. Do not submit a manifest.","command":"Record whether networks other than the Airbyte server can reach the Connector Builder or Manifest Server service, whether Workspace Reader and Organization Reader roles are limited to trusted users, and, on 1.x, whether the install still uses the legacy Helm chart that ignored global.auth.enabled.","affectedMeans":"A self-managed install is below 2.2.0 and either untrusted users hold Reader (or higher) roles, or (on 1.x) untrusted networks can reach the service.","fixedMeans":"The install is 2.2.0 or later, or only the Airbyte server can reach the service and Reader roles are limited to trusted users (workaround only).","notes":"Network and role limits are workarounds, not a software fix.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]}],"limits":["No sourced Shodan or Censys fingerprint. Do not invent a port or banner.","CVE-keyed scanners will not flag this bug while it has no CVE.","Airbyte Cloud customers need no action.","Do not submit a crafted manifest."],"sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"},{"url":"https://docs.airbyte.com/release_notes/self-managed/v-2.2","date":"2026-08-10","publisher":"Airbyte"}],"updatedAt":"2026-11-05","addedDate":"2026-11-05"},"mitigations":{"summary":"GHSA documents two workarounds until you can upgrade: allow only the Airbyte server to reach Connector Builder / Manifest Server, and limit Reader roles to trusted users. Neither replaces 2.2.0.","items":[{"title":"Allow only the Airbyte server to reach Connector Builder / Manifest Server","detail":"GHSA: restrict network access to the Connector Builder / Manifest Server service so that only the Airbyte server can reach it.","limits":"Not a software fix. 2.x users who can submit a manifest through the Airbyte server remain in scope. Still upgrade to 2.2.0.","verify":"Untrusted networks can no longer complete a connection to the Connector Builder / Manifest Server service. Confirm at the edge or service ACL, then re-check after the next change window. Do not submit a manifest as a test.","source":{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}},{"title":"Limit Workspace Reader and Organization Reader roles to trusted users","detail":"GHSA: limit Workspace Reader and Organization Reader access to trusted users. 2.x before 2.2.0 needs one of those roles or higher.","limits":"Not a software fix. 1.x on the legacy Helm chart did not inherit global.auth.enabled, so role limits do not close that network path. Still upgrade.","verify":"Workspace Reader and Organization Reader membership is limited to named trusted users. Re-check after the next access review. Do not submit a manifest as a test.","source":{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}}],"updatedAt":"2026-11-05","addedDate":"2026-11-05"},"response":{"summary":"If a self-managed install below 2.2.0 was reachable while untrusted users could submit a manifest, or while 1.x Connector Builder was on the network without auth, treat the Manifest Server container as exposed. Upgrade, review container logs, and rotate credentials stored in or reachable from Airbyte. No sourced persistence paths or IOCs were published.","containment":[{"title":"Upgrade to 2.2.0 or later","detail":"GHSA: 2.2.0 is the fix. 1.x has no fix on that line.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]},{"title":"Restrict Connector Builder / Manifest Server to the Airbyte server","detail":"GHSA workaround until the upgrade lands.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]},{"title":"Review container logs and unexpected child processes","detail":"Hunt manifest test-reads that reference custom components, and unexpected children of the manifest-server Python process. A hit is a lead, not proof.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]}],"rotate":[{"item":"Credentials stored in or reachable from Airbyte","reason":"GHSA: successful use may expose data, credentials and secrets available to the affected container. Because exploitation is reported, rotate those credentials.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]}],"evidence":[{"title":"Installed Airbyte version from before the upgrade","detail":"Keep the UI version or Helm appVersion so you can show whether the install was below 2.2.0.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]},{"title":"Connector Builder / Manifest Server container logs","detail":"Keep logs covering manifest test-reads that reference custom components from the exposure window.","sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]},{"title":"Process and egress telemetry for the Manifest Server container","detail":"Keep child-process and egress records for that container from the exposure window. No sourced persistence path was published.","generic":true,"sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"}]}],"limits":["No sourced persistence paths or IOCs were published.","JVN reports in-the-wild use and names no actor, victim count, or IOCs.","Airbyte has not stated exploitation.","No public PoC indexed as of 5 Nov 2026."],"sources":[{"url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","publisher":"Airbyte"},{"url":"https://jvn.jp/en/jp/JVN12040144/index.html","date":"2026-11-04","publisher":"JPCERT/CC"}],"updatedAt":"2026-11-05","addedDate":"2026-11-05"},"bulletins":[],"coverage":[{"title":"GHSA-g35w-6r6v-h4r7","publisher":"Airbyte","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","date":"2026-10-17","type":"vendor","addedDate":"2026-11-05"},{"title":"Airbyte 2.2 release notes","publisher":"Airbyte","url":"https://docs.airbyte.com/release_notes/self-managed/v-2.2","date":"2026-08-10","type":"vendor","addedDate":"2026-11-05"},{"title":"airbyte-python-cdk pull request 1076","publisher":"Airbyte","url":"https://github.com/airbytehq/airbyte-python-cdk/pull/1076","date":"2026-07-22","type":"vendor","addedDate":"2026-11-05"},{"title":"JVN#12040144: Airbyte vulnerable to arbitrary code execution","publisher":"JPCERT/CC","url":"https://jvn.jp/en/jp/JVN12040144/index.html","date":"2026-11-04","type":"government","addedDate":"2026-11-05"},{"title":"Airbyte Vulnerability Exploited in the Wild Lets Attackers Run Code in Connector Builder","publisher":"SecurityOnline","url":"https://securityonline.info/airbyte-vulnerability-exploited/","date":"2026-11-04","type":"news","addedDate":"2026-11-05"},{"title":"JPCERT/CC Warns Airbyte CVSS 9.9 Flaw Is Exploited in the Wild","publisher":"Daily Security Review","url":"https://dailysecurityreview.com/resources/jpcert-cc-warns-airbyte-cvss-9-9-flaw-is-exploited-in-the-wild/","date":"2026-11-04","type":"news","addedDate":"2026-11-05"},{"title":"Airbyte Connector Builder manifest class injection allows command execution even with unsafe code disabled","publisher":"Upwind","url":"https://www.upwind.io/feed/threat-post/airbyte-connector-builder-manifest-class-injection-allows-command-execution-even-with-unsafe-code-disabled","date":"2026-11-04","type":"news","addedDate":"2026-11-05"},{"title":"CISA KEV catalog JSON (no Airbyte CVE listed; catalog 2026.11.04)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-11-04","type":"government","addedDate":"2026-11-05"}],"posts":[],"research":[{"title":"GHSA-g35w-6r6v-h4r7","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","authors":"schecthellraiser606 (reporter)","date":"2026-10-17"},{"title":"JVN#12040144: Airbyte vulnerable to arbitrary code execution","url":"https://jvn.jp/en/jp/JVN12040144/index.html","authors":"Takeyasu Hyodo, ZOZO, Inc.; JPCERT/CC coordinating","date":"2026-11-04"}],"impact":{"kind":"single-product","product":"Airbyte Connector Builder / Manifest Server (self-managed)","versions":[{"version":"Airbyte self-managed 2.x before 2.2.0; Workspace Reader or Organization Reader or higher","status":"affected","versions":"2.2.0","vendorStatement":{"date":"2026-10-17","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","quote":"Airbyte 2.x before 2.2.0: an authenticated user with Workspace Reader or Organization Reader access (or higher) could execute commands in the Manifest Server container."},"addedDate":"2026-11-05"},{"version":"Airbyte 1.x (all deployments)","status":"eol-migrate","versions":"No 1.x fix. Upgrade to 2.2.0","vendorStatement":{"date":"2026-10-17","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","quote":"Airbyte 1.x will not receive a fix. Users should upgrade to 2.2.0 or later. Airbyte 1.x deployed with the legacy Helm chart: the Connector Builder service did not inherit the global.auth.enabled setting, so any client with network access to the Connector Builder service could exploit the issue without authenticating."},"addedDate":"2026-11-05"},{"version":"Airbyte Cloud","status":"vendor-managed-no-action","vendorStatement":{"date":"2026-10-17","url":"https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7","quote":"Airbyte Cloud customers do not need to take any action."},"addedDate":"2026-11-05"}]},"pocs":[],"pocEmptyState":"No public PoC indexed as of 5 Nov 2026. This site does not copy exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/airbyte-connector-builder-rce","json":"https://vuln2shell.com/vulns/airbyte-connector-builder-rce.json","iocsCsv":"https://vuln2shell.com/vulns/airbyte-connector-builder-rce/iocs.csv","stix":"https://vuln2shell.com/vulns/airbyte-connector-builder-rce/stix.json","badges":{"patch":"Patched","itw":"Reported exploited","poc":"No public PoC indexed"}}}