Airbyte Connector Builder: arbitrary code execution via custom components even with unsafe code disabled (GHSA-g35w-6r6v-h4r7), exploited in the wild

Self-managed Airbyte before 2.2.0 let Connector Builder / Manifest Server load unintended Python classes from a declarative manifest custom component, even when AIRBYTE_ENABLE_UNSAFE_CODE was off, so a user who could submit a test-read manifest could run commands inside those containers. On Airbyte 2.x that needs Workspace Reader or Organization Reader (or higher); on Airbyte 1.x with the legacy Helm chart the Connector Builder ignored global.auth.enabled, so anyone who could reach that service could exploit it unauthenticated. Successful exploitation may expose credentials and secrets in the container and reach internal services. Fixed in Airbyte 2.2.0 (manifest-server 7.23.7); Airbyte 1.x will not get a fix and should upgrade to 2.2.0+. Airbyte Cloud is not affected. JVN#12040144 (published Nov 4 2026) states the flaw has been confirmed exploited in the wild. Workarounds until you upgrade: restrict network access to Connector Builder / Manifest Server to the Airbyte server only, and limit Reader roles to trusted users.

Why this severity: GitHub rates GHSA-g35w-6r6v-h4r7 Critical (CVSS 3.1 9.9 with scope change); JVN rates CVSS 3.0 8.8 / CVSS 4.0 8.7 and says exploitation in the wild is confirmed. Self-managed only; Cloud customers need no action. Airbyte 1.x has no patch.

Started

Oct 17, 2026

• #Airbyte
• RCE
• #Data integration