Airbyte OneDrive Connector Vulnerable to Server-Side Request Forgery
A critical Server-Side Request Forgery (SSRF) vulnerability in Airbyte's OneDrive connector allows authenticated attackers to initiate arbitrary server-side requests, potentially leading to information disclosure.
The Zero Day Initiative (ZDI) has disclosed a significant Server-Side Request Forgery (SSRF) vulnerability, tracked as CVE-2026-92204, affecting Airbyte's popular OneDrive connector. This flaw, assigned a CVSS score of 7.7, enables authenticated remote attackers to compel the Airbyte instance to make arbitrary requests to external or internal resources.
The vulnerability resides within the _get_shared_drive_object method of the connector. The core issue stems from a failure to properly validate Uniform Resource Identifiers (URIs) before the application attempts to access resources. This lack of validation allows an attacker, who has already gained authenticated access to the Airbyte instance, to manipulate the connector into sending requests to unintended destinations.
Exploitation of this SSRF vulnerability can lead to information disclosure. By crafting specific requests, an attacker can leverage the service account's context to probe internal networks or access sensitive data that the Airbyte instance has permissions to reach. This could include internal APIs, metadata services, or other network resources that are not intended to be exposed externally.
Details of the vulnerability were first reported to the vendor by ZDI on October 29, 2025. Following up on the initial report, ZDI confirmed the vendor's receipt of the information on February 2, 2026. After a period of communication, ZDI notified the vendor of their intention to publish the advisory as a zero-day disclosure on March 30, 2026, given the lack of a patch.
The coordinated public release of the advisory occurred on September 16, 2026, with an update to the advisory also published on the same day. The vulnerability was discovered by Peter Girnus and Brandon Niemczyk of Trend Zero Day Initiative. As of the advisory's publication, no specific patches or updates have been released by Airbyte to address this vulnerability.
Given the nature of SSRF vulnerabilities, the primary mitigation strategy recommended by security researchers is to restrict the network access and interaction capabilities of the Airbyte product. This may involve network segmentation, firewall rules, or limiting the types of external requests the Airbyte instance is permitted to make. Organizations using the Airbyte OneDrive connector should carefully review their security posture and network configurations.
This disclosure highlights the ongoing risks associated with data integration platforms and their connectors. As organizations increasingly rely on tools like Airbyte to move and transform data, vulnerabilities within these connectors can become critical entry points for attackers. The SSRF flaw in the OneDrive connector underscores the importance of thorough security validation for all components involved in data pipelines.
Users of Airbyte's OneDrive connector are strongly advised to monitor for official security advisories from Airbyte and ZDI. Implementing strict network controls and access restrictions around the Airbyte deployment is crucial to mitigate the potential impact of this vulnerability until a permanent fix is available.
This new advisory from Zero Day Initiative details a Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-92203, specifically within Airbyte's SharePoint Connector, distinct from the previously reported OneDrive connector flaw. The vulnerability, assigned a CVSS score of 7.7, allows authenticated attackers to initiate arbitrary server-side requests by exploiting a lack of proper URI validation in the _get_shared_drive_object method, potentially leading to information disclosure.