The Zero Day Initiative published ZDI-26-704, an unpatched vulnerability in the Airbyte OneDrive connector identified as CVE-2026-92204. The flaw exists in the connector’s _get_shared_drive_object path and is a server-side request forgery (SSRF) that can be used for information disclosure. ZDI rates it CVSS 7.7. The important defender detail: authentication is required, so this is not an anonymous internet spray-and-pray bug, but it is still dangerous because Airbyte deployments often run with broad cloud credentials, powerful connector permissions, and network reachability into internal services that the browser user should never touch.
At time of writing, the public summary does not confirm in-the-wild exploitation, a public weaponized PoC, or CISA KEV inclusion. Treat it as an unpatched, high-severity SSRF in a data-movement platform. SSRF in ELT tooling is not just a web bug; it is a potential bridge from a control-plane credential to metadata services, Kubernetes APIs, Docker sockets, internal admin ports, and cloud identity material.
Technical analysis
Affected component: Airbyte OneDrive connector, specifically the _get_shared_drive_object code path. Public details do not enumerate exact affected version ranges, so defenders should assume exposure until Airbyte publishes fixed connector/platform versions and confirms otherwise.
CVE / CVSS: CVE-2026-92204, CVSS 7.7 per ZDI.
How it works, defensively: An authenticated user able to configure or trigger the OneDrive connector can influence a server-side request made by Airbyte rather than by the user’s browser. The impact depends on where the Airbyte server/worker can egress. If workers run in AWS, Azure, GCP, Kubernetes, or Docker without strict egress controls, a successful SSRF can be aimed at link-local metadata endpoints such as 169.254.169.254, cloud-specific metadata names, localhost services bound only to the host, container orchestration APIs, or internal HTTP services that trust network location.
The realistic attack chain is: authenticated Airbyte UI/API access → create or modify a OneDrive source/connection or trigger a sync/schema discovery path that reaches _get_shared_drive_object → Airbyte server/worker performs an attacker-influenced HTTP request → response or error behavior discloses internal data, tokens, instance metadata, reachable hosts, or timing differences. Because Airbyte frequently stores cloud and SaaS credentials, even partial disclosure can be enough to pivot.
Exploitation status: Public reporting indicates unpatched status; no confirmed active exploitation or KEV listing is stated in the summary. Do not wait for a PoC. SSRF primitives are easy to operationalize once researchers publish connector details.
Immediate defensive priorities
- Identify every Airbyte deployment, including dev, staging, ephemeral Docker Compose, Helm/Kubernetes, and cloud marketplace installs.
- Treat Airbyte egress as hostile until patched: allowlist only required destinations such as Microsoft Graph/login endpoints for OneDrive and your declared destinations.
- Deny Airbyte server/worker access to link-local, loopback, cloud metadata, Kubernetes API, Docker daemon, and unmanaged internal admin ports unless explicitly required.
- Remove broad cloud instance roles from Airbyte nodes; require IMDSv2, set metadata hop limit to 1, and use workload identity scoped to minimum needed permissions.
- Audit OneDrive connector configurations and recent authenticated UI/API activity for unexpected source changes, new connections, or syncs outside change windows.
Detection content
Scope these to Airbyte hosts, containers, subnets, namespaces, and service accounts. A raw deny on RFC1918 from Airbyte will usually break legitimate connectors; prioritize metadata, link-local, loopback, orchestration, and admin-plane access.
---
title: Airbyte Process Egress to Cloud Metadata or Link-Local
id: 9a2b7c10-6d51-4f43-9a2d-c0f7a9d61101
status: experimental
description: Detects Airbyte-like Java/Python processes initiating connections to link-local or cloud metadata addresses commonly targeted by SSRF.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-704/
- https://attack.mitre.org/techniques/T1090/
author: Security Arsenal
date: 2026/02/12
tags:
- attack.exfiltration
- attack.t1090
- attack.t1552.005
logsource:
category: network_connection
product: linux
detection:
selection_img:
Image|endswith:
- '/java'
- '/python'
- '/python3'
selection_net:
DestinationIp|startswith:
- '169.254.'
DestinationPort:
- 80
- 443
condition: selection_img and selection_net
falsepositives:
- Cloud agents on the same host; scope with host, container, namespace, or command-line context for Airbyte before enabling blocking actions.
level: high
---
title: Airbyte Egress to Internal Control Plane and Admin Services
id: 4cc8f30a-1b5e-4c2a-a7d7-3a2c7e0c9222
status: experimental
description: Detects Airbyte-like runtime processes connecting to orchestration, container, remote administration, and other high-value internal ports often exposed through SSRF pivots.
references:
- http://www.zerodayinitiative.com/advisories/ZDI-26-704/
- https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/02/12
tags:
- attack.lateral_movement
- attack.discovery
- attack.t1021
- attack.t1046
logsource:
category: network_connection
product: linux
detection:
selection_img:
Image|endswith:
- '/java'
- '/python'
- '/python3'
selection_internal:
DestinationIp|startswith:
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.2'
- '172.30.'
- '172.31.'
- '192.168.'
- '127.'
selection_ports:
DestinationPort:
- 22
- 2375
- 2376
- 2379
- 2380
- 3389
- 5985
- 5986
- 6443
- 10250
- 10255
- 10257
- 10259
condition: selection_img and selection_internal and selection_ports
falsepositives:
- Legitimate Airbyte connectors to internal databases or APIs; baseline declared connector destinations and alert on new destinations, service accounts, or namespaces.
level: medium
let AirbyteProc = dynamic(['java','python','python3']);
let MetadataPrefixes = dynamic(['169.254.']);
let AdminPorts = dynamic([22,2375,2376,2379,2380,3389,5985,5986,6443,10250,10255,10257,10259]);
union isfuzzy=true
(DeviceNetworkEvents
| where InitiatingProcessFileName in~ (AirbyteProc)
| where InitiatingProcessFolderPath has_any ('airbyte','connector') or InitiatingProcessCommandLine has_any ('airbyte','one drive','onedrive')
| where ipv4_is_in_range(RemoteIP,'169.254.0.0/16')
or RemoteIP in ('127.0.0.1','0.0.0.0')
or (ipv4_is_private(RemoteIP) and RemotePort in (AdminPorts))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
),
(CommonSecurityLog
| where SourceHostName has_any ('airbyte') or DeviceName has_any ('airbyte')
| where ipv4_is_in_range(DestinationIP,'169.254.0.0/16')
or DestinationIP in ('127.0.0.1','0.0.0.0')
or (ipv4_is_private(DestinationIP) and DestinationPort in (AdminPorts))
| project TimeGenerated, SourceHostName, DeviceName, SourceIP, DestinationIP, DestinationPort, Protocol, ApplicationProtocol, RequestURL, RequestMethod
)
| order by TimeGenerated desc
-- Scope: Airbyte server/worker hosts. First find likely Airbyte runtimes and connector artifacts, then correlate with netstat for metadata/control-plane egress.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'airbyte|one[-_ ]?drive|connector'
OR Exe =~ 'airbyte|connector|java|python'
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE RemoteAddr =~ '169[.]254[.]|127[.]0[.]0[.]1|0[.]0[.]0[.]0'
OR RemotePort in (22,2375,2376,2379,2380,3389,5985,5986,6443,10250,10255,10257,10259)
Emergency hardening script
Run in audit mode first. The optional apply mode only blocks the highest-confidence SSRF targets: IPv4 link-local/metadata. It does not patch Airbyte.
#!/usr/bin/env bash
set -euo pipefail
MODE="${1:-audit}"
CHAIN='AIRBYTE_SSRF_GUARD'
echo "[i] mode=${MODE}"
echo '[i] Airbyte containers/images:'
(docker ps --format '{{.Names}} {{.Image}} {{.Ports}}' 2>/dev/null || true) | grep -Ei 'airbyte|one.?drive' || true
(kubectl get pods -A -o wide 2>/dev/null || true) | grep -Ei 'airbyte|one.?drive' || true
echo '[i] Listening/high-value local services reachable from host:'
(ss -lntup 2>/dev/null || netstat -lntup 2>/dev/null || true) | grep -E ':(22|2375|2376|3389|5985|5986|6443|10250|10255)\b' || true
echo '[i] Metadata reachability test from this host (should fail after hardening):'
(timeout 3 curl -sS -m 2 http://169.254.169.254/ >/dev/null 2>&1 && echo 'METADATA_REACHABLE=yes') || echo 'METADATA_REACHABLE=no-or-timeout'
echo '[i] Recent Airbyte/OneDrive log hits, if journald/docker logs are present:'
(journalctl -k -n 200 --no-pager 2>/dev/null || true) | grep -Ei 'airbyte|_get_shared_drive_object|onedrive|169\.254\.169\.254' || true
(docker logs --tail 200 $(docker ps -q --filter name=airbyte 2>/dev/null) 2>/dev/null || true) | grep -Ei '_get_shared_drive_object|onedrive|169\.254\.169\.254|ssrf|shared.?drive' || true
if [[ "${MODE}" == '--apply' ]]; then
command -v iptables >/dev/null || { echo '[!] iptables not found'; exit 1; }
iptables -N "${CHAIN}" 2>/dev/null || true
iptables -C OUTPUT -j "${CHAIN}" 2>/dev/null || iptables -I OUTPUT 1 -j "${CHAIN}"
for net in 169.254.0.0/16; do
iptables -C "${CHAIN}" -d "${net}" -p tcp -j REJECT --reject-with tcp-reset 2>/dev/null || \
iptables -A "${CHAIN}" -d "${net}" -p tcp -j REJECT --reject-with tcp-reset
done
echo '[i] Applied host OUTPUT guard for IPv4 link-local/metadata. Prefer namespace/Kubernetes NetworkPolicy for production.'
fi
Remediation and compensating controls
Patch status: No fixed version is identified in the public summary, and ZDI lists the issue as unpatched. Monitor the ZDI advisory at http://www.zerodayinitiative.com/advisories/ZDI-26-704/, the Airbyte GitHub releases/connector changelog, and your Airbyte Helm chart/image digest feed. Upgrade immediately when Airbyte publishes a fixed connector or platform release; verify the running image digest after deployment because connector updates can lag platform releases.
Until patched:
- Put an explicit egress proxy in front of Airbyte server/worker traffic. For OneDrive, allow only approved Microsoft identity and Graph endpoints plus required destination endpoints. Deny by default.
- Enforce Kubernetes NetworkPolicy or cloud firewall rules that block
169.254.0.0/16, loopback, and non-approved internal CIDRs from Airbyte namespaces. Be surgical: many legitimate Airbyte connectors are internal, so inventory declared sources/destinations first. - In AWS, require IMDSv2 and set instance metadata hop limit to 1 for Airbyte nodes; in containers, block metadata via network policy. In Azure/GCP, restrict metadata access and use managed identities/workload identity with least privilege instead of node-wide credentials.
- Remove privileged Docker socket mounts, host networking, hostPath access, cluster-admin bindings, and broad service account tokens from Airbyte workers.
- Limit who can create/edit connectors and connections. Enforce SSO+MFA, separate admin roles, change approval for new connectors, and alerting on OneDrive connector create/update/delete events.
- Rotate credentials if you find suspicious connector changes or egress to metadata/internal control planes: Airbyte stored secrets, OneDrive/Graph app secrets, cloud instance credentials, Kubernetes service accounts, and any internal tokens reachable from the Airbyte network segment.
Validation checklist after controls: From an Airbyte worker context, curl to http://169.254.169.254/, Kubernetes API, Docker daemon, localhost-only services, and representative internal admin ports should fail. Approved OneDrive/Graph flows should still complete. Test schema discovery and a small sync before declaring the workaround safe.
Executive takeaway
This is a classic modern SSRF: the vulnerability is in a connector, but the blast radius is defined by egress and identity. Because exploitation requires authentication, strong tenant hygiene helps, but it is not a control by itself. Assume a malicious or compromised authenticated user can turn Airbyte into an internal request proxy until a fixed connector is deployed and verified. Reduce blast radius now with deny-by-default egress, metadata hardening, least-privilege workload identity, and targeted hunting for metadata/control-plane connections from Airbyte runtimes.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.