--- title: "Airbyte Connector Builder Flaw Exploited in the Wild" description: "Airbyte fixed a critical Connector Builder flaw in 2.2.0. JPCERT/CC confirms exploitation in the wild. Airbyte 1.x gets no fix. Upgrade now." url: https://policycortex.com/blog/airbyte-connector-builder-exploited sealed: 2026-11-05 register: blog/airbyte-connector-builder-exploited records: 3 digest: sha3:588a02e1e06036eb3612ec47ee84980df4d4025b3692aad1d130bac4a93d6adb --- # Airbyte Connector Builder Flaw Is Being Exploited, Patch to 2.2.0 Resources / Blog Airbyte fixed a critical Connector Builder flaw in version 2.2.0. JPCERT/CC confirms attackers are already using it. Airbyte 1.x gets no fix. Leonard Esere · Sealed 2026-11-05 · Reading time 5 min Filed under: [Airbyte](https://policycortex.com/blog/tags/airbyte), [Connector Builder](https://policycortex.com/blog/tags/connector-builder), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [evidence](https://policycortex.com/blog/tags/evidence) **Summary** - JPCERT/CC confirms the flaw is exploited in the wild. - The flaw is unsafe reflection in Connector Builder. - All Airbyte versions before 2.2.0 are affected. - Airbyte 1.x will not receive a fix. ## What Airbyte fixed in 2.2.0 Airbyte published a security advisory for its Connector Builder. The flaw is unsafe reflection, listed as Common Weakness Enumeration (CWE) 470. Connector Builder and Manifest Server did not limit which Python classes a manifest could call. A user who could submit a manifest could load Python objects already in the container. That load could run arbitrary commands inside the container. The flaw worked even when unsafe code was turned off. Airbyte rates the flaw critical, with a Common Vulnerability Scoring System (CVSS) 3.1 score of 9.9. The Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) lists 8.8 under CVSS 3.0 and 8.7 under CVSS 4.0. Use the 9.9 vendor score as the planning number. ## Exploitation is confirmed Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) states the flaw is exploited in the wild. The advisory was published on November 4, 2026. Airbyte 2.x before 2.2.0 is affected. An authenticated user with Workspace Reader access or higher could run commands in the Manifest Server container. Airbyte 1.x with the legacy Helm chart is worse. There, any client with network access to Connector Builder could exploit it without logging in. Airbyte 1.x will not receive a fix. Airbyte Cloud customers need no action. ## What to do now Upgrade self-managed Airbyte to 2.2.0 or later. That release ships manifest-server 7.23.7. Restrict network access to Connector Builder and Manifest Server until the upgrade lands. Limit Workspace Reader and Organization Reader access to trusted users. Review container logs for odd manifest submissions. Rotate stored credentials that the container could reach. ## The governance lesson A data tool holds the keys to other systems. Connector Builder reaches sources, targets, and secrets. A flaw in that tool is a flaw in every pipeline it touches. Version 1.x has no fix, so an upgrade is the only path. Record the Airbyte version on each deployment. Record the upgrade date and the new version. Record who holds Reader access on each workspace. That record turns a version check into proof. ## Sources - Airbyte security advisory GHSA-g35w-6r6v-h4r7, Remote code execution via Connector Builder custom components when unsafe code is disabled. https://github.com/airbytehq/airbyte/security/advisories/GHSA-g35w-6r6v-h4r7 - JPCERT/CC advisory JVN12040144, Airbyte vulnerable to arbitrary code execution, November 4, 2026. https://jvn.jp/en/jp/JVN12040144/ - SecurityOnline coverage, November 4, 2026. https://securityonline.info/airbyte-vulnerability-exploited/ - Original diagram by PolicyCortex. ## Next step Upgrade self-managed Airbyte to 2.2.0, then confirm the version on every deployment. **Questions on this record** **Q: Which versions are affected?** A: All Airbyte versions before 2.2.0 are affected. Airbyte 1.x will not receive a fix. Upgrade to 2.2.0 or later. **Q: Is exploitation confirmed?** A: Yes. JPCERT/CC states the flaw has been confirmed as exploited in the wild. The advisory was published on November 4, 2026. **Q: Does Airbyte Cloud need action?** A: No. Airbyte states that Airbyte Cloud customers do not need to take any action. **Q: Is there a CVE number?** A: No CVE number was listed in the advisories as of November 5, 2026. The GHSA advisory and the JVN record are the primary sources. ## Related records Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page. - **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained. - **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes. - **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it. - **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence. ### Further reading in this register | Published | Entry | Reading | |---|---|---| | 2026-11-05 | [Zyxel GS1900 Zero-Day Hit Nearly 1,000 Switches After a Patch Missed It](https://policycortex.com/blog/zyxel-gs1900-zero-day-switch-compromise): Zyxel patched a GS1900 zero-day on October 22, 2026. Attackers had already used it to take over 996 switches. The June fix did not stop it. | 5 min | | 2026-11-04 | [Barracuda Email Gateway Chain Needs a Fast Patch, and a Close Read](https://policycortex.com/blog/barracuda-esg-root-chain-patch): Barracuda patched a 9.3 gateway flaw and an 8.6 command injection flaw on November 2, 2026. Chained on Email Security Gateway, they could yield root access. Read the advisory closely before you judge exposure. | 5 min | | 2026-11-04 | [WordPress Upgrade Window Flaw Joins the Exploited List](https://policycortex.com/blog/wordpress-kev-upgrade-window-rce): CISA added the WordPress upgrade window flaw to its exploited list on November 3, 2026. Sites must move to 7.1.4 or a patched branch release, then check for signs of entry. | 5 min | Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) Dates of record - **Published**: 2026-11-05 - **Last updated**: Unchanged since sealing - **Author**: Leonard Esere - **Record**: https://policycortex.com/blog/airbyte-connector-builder-exploited ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | HEAD | e2bf17394b87 | 7a94fc36cfbf | | REC 0001 | BODY | 44c3cb1eae90 | e2bf17394b87 | | REC 0002 | RELATED RECORDS | 588a02e1e060 | 44c3cb1eae90 | Head sha3:588a02e1e06036eb3612ec47ee84980df4d4025b3692aad1d130bac4a93d6adb. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.