Published:2026/11/04  Last Updated:2026/11/04

JVN#12040144
Airbyte vulnerable to arbitrary code execution
Critical

Overview

Airbyte contains a vulnerability that allows arbitrary code execution due to improper class loading of unintended components.

Products Affected

  • Airbyte versions prior to 2.2.0

Description

Airbyte contains the following vulnerability:

  • Unsafe Reflection (CWE-470)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.7
    • CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.8
Note that the vulnerability has been confirmed to be exploited in the wild.

Impact

An attacker may execute arbitrary code with the privileges of the Airbyte user in the Connector Builder or Manifest Server container.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

Vendor Status

Vendor Link
Airbyte Airbyte 2.2
Remote code execution via Connector Builder custom components when unsafe code is disabled

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Takeyasu Hyodo of ZOZO, Inc. reported this vulnerability to the developer and IPA.
JPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE
JVN iPedia