32 matches found
CVE-2026-80049
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
EUVD-2026-65701
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
CVE-2026-80049
Airbyte Platform through 2.0.0 suffers a cross-workspace authorization bypass. The root cause is that AuthorizationServerHandler extracts a caller-supplied workspaceId from the raw JSON request body and sets it in the X-Airbyte-Workspace-Id header, which AuthenticationHeaderResolver.resolveWorksp...
CVE-2026-80049 Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
PT-2026-81484
Name of the Vulnerable Software and Affected Versions Airbyte Platform affected versions not specified Description An issue exists where the platform determines the workspace for authorization decisions based on a field supplied by the caller. The AuthorizationServerHandler copies recognized...
CVE-2026-80049: Authorization Bypass Through User-Controlled Key
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte- headers, and AuthenticationHeaderResolver.resolveWorkspace consults...
GHSA-MFG7-5GFP-C4W3 vulnerabilities
Vulnerabilities for packages: spark-fips, kafka-bridge-fips, celeborn, request-9047-keycloak-fips, seata, hono, kafbat-ui-fips, airbyte-server-fips, s3proxy, akhq, spark-kubernetes-operator, zipkin, kayenta-fips, elasticsearch, apache-hop, s3proxy-fips, elasticsearch-fips, pinot-fips,...
GHSA-387M-935M-C4VW vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
GHSA-Q6GH-6V2R-HJV3 vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
GHSA-43W5-MMXV-CPVH vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
CVE-2026-33012 vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
CVE-2026-33013 vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
GHSA-2HCP-GJRF-7FHC vulnerabilities
Vulnerabilities for packages: airbyte-server-fips, airbyte-server...
Malicious Package
Overview linear-airbyte-source is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2024-37279
Malicious code in bioql PyPI...
Malicious Package
Overview airbyte-webapp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in airbyte-webapp (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cb9621dfdc8c213cde4d731ad33b75a36cc9298649d12d5ed1669fb3d401f1c Any computer that has this package installed or running should be considered...
MAL-2025-47843 Malicious code in airbyte-webapp (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cb9621dfdc8c213cde4d731ad33b75a36cc9298649d12d5ed1669fb3d401f1c Any computer that has this package installed or running should be considered...