Airbyte Connector Builder flaw exploited to run code in containers

Japan’s JPCERT/CC has warned that Airbyte’s Connector Builder vulnerability allows arbitrary code execution and has been “confirmed to be exploited in the wild.” The flaw affects all Airbyte versions prior to 2.2.0, with Airbyte rating the bug as critical (CVSS 3.1 score 9.9). The advisory notes active exploitation, and the JV N advisory JVN12040144 confirms the issue is being leveraged in real attacks.

Airbyte Cloud customers are told no action is required on their side, but self-managed deployments should upgrade to Airbyte 2.2.0 or later, which ships manifest-server 7.23.7. The vendor also points to its security advisory GHSA-g35w-6r6v-h4r7 for mitigation details. Evidence of exploitation is described by JPCERT/CC, though it does not specify attacker group or the number of affected systems.

The vulnerability lies in Connector Builder accepting declarative manifests that describe a data connector; prior to 2.2.0 the service did not restrict which Python classes a manifest could reference, allowing it to invoke unintended Python objects present in the container. This unsafe reflection (CWE-470) can enable command execution within the affected container, even when AIRBYTE_ENABLE_UNSAFE_CODE is not enabled.

Exploitable users include Airbyte 2.x versions before 2.2.0 with Workspace Reader or Organisation Reader access (or higher); Airbyte 1.x on the legacy Helm chart could be accessed by anyone with network access due to missing authentication enforcement. Upgrading to 2.2.0+ is advised, and if patching is not possible, administrators should restrict access to the Connector Builder/manifests server and limit reader roles to trusted users, while reviewing container logs and rotating credentials.