In this article
  1. What happened
  2. Who is exposed
  3. Exploitation status
  4. What to do
  5. Updates

On October 17, 2026 (UTC), Airbyte published security advisory GHSA-g35w-6r6v-h4r7, “Remote code execution via Connector Builder custom components when unsafe code is disabled.” Airbyte rates it Critical, CVSS 3.1 9.9. Japan’s JVN published JVN#12040144 on November 4, and says “the vulnerability has been confirmed to be exploited in the wild.” Airbyte’s advisory does not mention exploitation.

What happened

In Airbyte versions before 2.2.0, the Connector Builder and Manifest Server did not restrict which Python classes a declarative manifest could reference as a custom component. Airbyte says a user able to submit a manifest for a Connector Builder test read could make the service run commands inside the Connector Builder or Manifest Server container. This worked even when AIRBYTE_ENABLE_UNSAFE_CODE was not enabled.

JVN classifies it as Unsafe Reflection (CWE-470) and scores it CVSS 4.0 8.7 and CVSS 3.0 8.8. Neither source lists a CVE ID.

Who is exposed

  • Airbyte 2.x before 2.2.0: any signed-in user with Workspace Reader or Organization Reader access, or higher, could run commands in the Manifest Server container.
  • Airbyte 1.x on the legacy Helm chart: the Connector Builder service did not inherit global.auth.enabled, so anyone with network access to it could exploit the flaw without signing in.
  • Airbyte Cloud: Airbyte says Cloud customers “do not need to take any action.”

Airbyte says a successful attack “may expose data, credentials and secrets available to the affected container,” and may allow access to internal services reachable from it.

Exploitation status

The exploitation report comes from JVN (JPCERT/CC and IPA). Airbyte’s advisory does not mention exploitation. As of CISA’s KEV feed dated November 4, 2026 (UTC), Airbyte is not in the Known Exploited Vulnerabilities catalog.

What to do

  1. Upgrade self-managed Airbyte to 2.2.0 or later. It ships airbyte/manifest-server 7.23.7 and rejects custom components in Connector Builder manifests unless AIRBYTE_ENABLE_UNSAFE_CODE=true.
  2. If you’re on 1.x, plan the move to 2.x. Airbyte says 1.x “will not receive a fix.”
  3. If you can’t upgrade yet: restrict network access to the Connector Builder / Manifest Server service so only the Airbyte server can reach it, and limit Workspace Reader and Organization Reader access to trusted users.
  4. Leave AIRBYTE_ENABLE_UNSAFE_CODE off unless every user with workspace access is trusted. Turning it on intentionally allows custom code.

Sources

Last checked: Nov 5, 2026, 2:58 p.m. Manila (UTC+8). Method: We read Airbyte’s advisory GHSA-g35w-6r6v-h4r7, JVN#12040144, Airbyte’s self-managed 2.2 release notes and CISA’s KEV catalog. Affected versions and fixes are quoted from Airbyte; the exploitation report comes from JVN. The thumbnail is an original OneSignalDesk card. No affiliate links. How we work.

Updates

  • Nov 5, 2026, 1:09 p.m. Manila: First published.

Spotted an error? See our corrections policy and tell us.