CVE-2026-80049

Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...

PT-2026-81484

Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...

CVE-2026-80049: Authorization Bypass Through User-Controlled Key

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +802 more potentially affected by CVE-2026-70626 via nltk (>=3.0.0, <=3.9.3)

nltk PYPI version =3.0.0, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.17.0, =0.0.0.dev0, =7.28.2.post5.dev33128883500 and more Source cves: CVE-2026-70626 Source advisory: OSV:PYSEC-2026-3732...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +804 more potentially affected by CVE-2026-66393 via nltk (>=2.0.4, <=3.9.3)

nltk PYPI version =2.0.4, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.17.0, =0.0.0.dev0, =7.28.2.post5.dev33128883500 and more Source cves: CVE-2026-66393 Source advisory: MEND:CVE-2026-66393...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-59894 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59894 Source advisory: OSV:PYSEC-2026-3696...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-71491 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-71491 Source advisory: SNYK:PYTHON-SQLPARSE-18905009...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-54284 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-54284 Source advisory: GHSA-PWGV-4X5Q-6M9F...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-59893 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59893 Source advisory: MEND:CVE-2026-59893...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-71491 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-71491 Source advisory: GHSA-F2FF-P2WW-7P4P...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-59894 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59894 Source advisory: OSV:GHSA-3496-9G83-7V6X...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-59894 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59894 Source advisory: MEND:CVE-2026-59894...

GHSA-MFG7-5GFP-C4W3 vulnerabilities

Vulnerabilities for packages: apache-nifi, spark-kubernetes-operator, keycloak-fips, opensearch-fips, spark-fips, apache-pulsar, opensearch, commercial-elasticsearch, kafka-bridge, druid, camunda-zeebe, apache-hop, kafbat-ui-fips, infinispan, kayenta, knative-kafka-broker-fips, elasticsearch,...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +799 more potentially affected by CVE-2025-71408 via nltk (>=3.0.0, <=3.9.2)

nltk PYPI version =3.0.0, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.17.0, =0.0.0.dev0, =7.28.2.post5.dev33128883500 and more Source cves: CVE-2025-71408 Source advisory: GHSA-848C-C2CX-J7QX...

aa-rag (>=0.4.2, <=0.4.3), aaa-ml-datasets-course (1.0.0) +801 more potentially affected by CVE-2025-71408 via nltk (>=2.0.4, <=3.9.2)

nltk PYPI version =2.0.4, =0.4.2, =0.2.3, =0.2.0, =0.0.4, =0.0.1, =0.1.0, =0.1.0, =0.0.9, =0.17.0, =0.0.0.dev0, =7.28.2.post5.dev33128883500 and more Source cves: CVE-2025-71408 Source advisory: MEND:CVE-2025-71408...

airbyte-source-jira (>=3.4.0.dev202412051939, <=3.4.0.dev202412052135), airbyte-source-klaviyo (>=2.11.0.dev202411212104, <=2.11.3.dev202412021626) +1 more potentially affected by CVE-2026-50271 via ddtrace (2.16.4)

ddtrace PYPI version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - airbyte-source-jira =3.4.0.dev202412051939, =2.11.0.dev202411212104, =5.14.0.dev202506051219, =5.14.0.dev202506111019 Source cves: CVE-2026-50271...

airbyte-source-jira (>=3.4.0.dev202412051939, <=3.4.0.dev202412052135), airbyte-source-klaviyo (>=2.11.0.dev202411212104, <=2.11.3.dev202412021626) +1 more potentially affected by CVE-2026-50271 via ddtrace (2.16.4)

ddtrace PYPI version 2.16.4 is affected by a known vulnerability. The following packages have a transitive dependency on ddtrace and may be impacted: - airbyte-source-jira =3.4.0.dev202412051939, =2.11.0.dev202411212104, =5.14.0.dev202506051219, =5.14.0.dev202506111019 Source cves: CVE-2026-50271...

GHSA-387M-935M-C4VW vulnerabilities

Vulnerabilities for packages: airbyte-server, airbyte-server-fips...

GHSA-Q6GH-6V2R-HJV3 vulnerabilities

Vulnerabilities for packages: airbyte-server, airbyte-server-fips...

airbyte-source-file (>=0.3.15, <=0.5.39), airbyte-source-sftp-bulk (0.1.2) +32 more potentially affected by CVE-2026-44405 via paramiko (2.11.0)

paramiko PYPI version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - airbyte-source-file =0.3.15, =1.0.21, =1.0.1, =0.1.0, =0.0.5, =1.0.10, =2.5.2, =0.0.0.8.1, =0.0.1, =0.0.1, =2.0.0, =0.0.1a0, =0.0.1b0 and more...