# Airbyte Connector Builder: arbitrary code execution via custom components even with unsafe code disabled (GHSA-g35w-6r6v-h4r7), exploited in the wild · pwn.watch > Self-managed Airbyte before 2.2.0 let Connector Builder / Manifest Server load unintended Python classes from a declarative manifest custom component, even when AIRBYTE_ENABLE_UNSAFE_CODE was off, so a user who could submit a test-read manifest could run commands inside those containers. On Airbyte 2.x that needs Workspace Reader or Organization Reader (or higher); on Airbyte 1.x with the legacy Helm chart the Connector Builder ignored global.auth.enabled, so anyone who could reach that service could exploit it unauthenticated. Successful exploitation may expose credentials and secrets in the container and reach internal services. Fixed in Airbyte 2.2.0 (manifest-server 7.23.7); Airbyte 1.x will not get a fix and should upgrade to 2.2.0+. Airbyte Cloud is not affected. JVN#12040144 (published Nov 4 2026) states the flaw has been confirmed exploited in the wild. Workarounds until you upgrade: restrict network access to Connector Builder / Manifest Server to the Airbyte server only, and limit Reader roles to trusted users. Page: https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7 · generated 2026-11-05T01:46:21.883Z ## Status - Severity: critical · status: live · patch: patched - Product: Airbyte (self-managed) - Started: 2026-10-17 - Affected: Airbyte < 2.2.0 (self-managed; includes 1.x and 2.x before 2.2.0) - Fixed in: Airbyte 2.2.0 (ships airbyte/manifest-server 7.23.7 / airbyte-cdk 7.23.7) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7/feed.xml - JSON Feed: https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7.json - This file: https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7/llms.txt ## Updates (newest first) - 2026-11-04: JVN#12040144 publishes the Airbyte arbitrary code execution issue and states the vulnerability has been confirmed to be exploited in the wild; upgrade self-managed deployments to the latest version. (https://jvn.jp/en/jp/JVN12040144/) - 2026-10-17: Airbyte publishes GHSA-g35w-6r6v-h4r7 describing Connector Builder / Manifest Server arbitrary command execution via unrestricted custom-component class loading, fixed in 2.2.0; Airbyte 1.x will not receive a fix. (https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7) - 2026-08-10: Airbyte 2.2.0 is released for self-managed deployments, shipping manifest-server 7.23.7 and rejecting Connector Builder custom components unless AIRBYTE_ENABLE_UNSAFE_CODE=true. (https://docs.airbyte.com/release_notes/self-managed/v-2.2) ## Fix brief # Security brief: Airbyte Connector Builder: arbitrary code execution via custom components even with unsafe code disabled (GHSA-g35w-6r6v-h4r7), exploited in the wild Source: https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7 · status: live · severity: critical · updated Nov 5, 2026, 01:18 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Self-managed Airbyte before 2.2.0 let Connector Builder / Manifest Server load unintended Python classes from a declarative manifest custom component, even when AIRBYTE_ENABLE_UNSAFE_CODE was off, so a user who could submit a test-read manifest could run commands inside those containers. On Airbyte 2.x that needs Workspace Reader or Organization Reader (or higher); on Airbyte 1.x with the legacy Helm chart the Connector Builder ignored global.auth.enabled, so anyone who could reach that service could exploit it unauthenticated. Successful exploitation may expose credentials and secrets in the container and reach internal services. Fixed in Airbyte 2.2.0 (manifest-server 7.23.7); Airbyte 1.x will not get a fix and should upgrade to 2.2.0+. Airbyte Cloud is not affected. JVN#12040144 (published Nov 4 2026) states the flaw has been confirmed exploited in the wild. Workarounds until you upgrade: restrict network access to Connector Builder / Manifest Server to the Airbyte server only, and limit Reader roles to trusted users. Severity detail: GitHub rates GHSA-g35w-6r6v-h4r7 Critical (CVSS 3.1 9.9 with scope change); JVN rates CVSS 3.0 8.8 / CVSS 4.0 8.7 and says exploitation in the wild is confirmed. Self-managed only; Cloud customers need no action. Airbyte 1.x has no patch. - Product: Airbyte (self-managed) ## Affected versions - Airbyte < 2.2.0 (self-managed; includes 1.x and 2.x before 2.2.0) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Airbyte 2.2.0 (ships airbyte/manifest-server 7.23.7 / airbyte-cdk 7.23.7) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes Self-managed Airbyte only. Check your deployment version; if below 2.2.0, upgrade to 2.2.0 or later (one-way migration — take a DB backup first; mirror manifest-server image tag 7.23.7 if you pin images). Airbyte 1.x has no fix. Until you upgrade, restrict network access to Connector Builder / Manifest Server so only the Airbyte server can reach it, and limit Workspace/Organization Reader roles to trusted users. After any suspected exposure, rotate credentials and secrets stored in or reachable from the Airbyte containers. Airbyte Cloud needs no action. ## Latest updates - Nov 4, 2026: JVN#12040144 publishes the Airbyte arbitrary code execution issue and states the vulnerability has been confirmed to be exploited in the wild; upgrade self-managed deployments to the latest version. - Oct 17, 2026: Airbyte publishes GHSA-g35w-6r6v-h4r7 describing Connector Builder / Manifest Server arbitrary command execution via unrestricted custom-component class loading, fixed in 2.2.0; Airbyte 1.x will not receive a fix. - Aug 10, 2026: Airbyte 2.2.0 is released for self-managed deployments, shipping manifest-server 7.23.7 and rejecting Connector Builder custom components unless AIRBYTE_ENABLE_UNSAFE_CODE=true. ## Advisories - [GHSA-g35w-6r6v-h4r7: Remote code execution via Connector Builder custom components when unsafe code is disabled](https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7) (airbytehq/airbyte) - [JVN#12040144: Airbyte vulnerable to arbitrary code execution](https://jvn.jp/en/jp/JVN12040144/) (JVN / JPCERT/CC / IPA) - [Airbyte 2.2 self-managed release notes](https://docs.airbyte.com/release_notes/self-managed/v-2.2) (Airbyte) ## Write-ups & news - [Airbyte Vulnerability Exploited in the Wild: Patch to 2.2.0](https://securityonline.info/airbyte-vulnerability-exploited/) --- Machine-readable: https://pwn.watch/i/airbyte-connector-builder-rce-ghsa-g35w-6r6v-h4r7.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.