Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80049— Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Quick assessment

Affected
airbytehq airbyte-platform
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Airbyte是Airbyte组织的一款数据集成平台。 Airbyte 2.0.0及之前版本存在授权问题漏洞，该漏洞源于从调用者提供的字段解析授权决策所使用的工作区，导致权限检查与资源所属工作区不一致，可能造成跨工作区授权绕过，任意工作区成员可读取源和目标配置、触发和取消同步、删除连接、源和目标。

CVSS 8.8 · High EPSS 0.43% · P37

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
airbytehq airbyte-platform ≤ 2.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Source: CVE Program / CVE List V5
Vulnerability Description
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destination identifiers. Endpoints whose declared request bodies carry only a resource identifier are nonetheless reached with an added workspaceId field, because the extractor reads the body rather than the endpoint's schema, so the permission check is performed against the workspace the caller nominated while the handler acts on the resource identifier the caller supplied. Nothing afterwards compares the resource's owning workspace with the one that was authorized. A member of any workspace can therefore read source and destination configuration, trigger and cancel syncs, and delete connections, sources and destinations that belong to workspaces they have no access to, at whatever privilege level their own workspace membership grants them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Vulnerability Title
Airbyte 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Airbyte是Airbyte组织的一款数据集成平台。 Airbyte 2.0.0及之前版本存在授权问题漏洞，该漏洞源于从调用者提供的字段解析授权决策所使用的工作区，导致权限检查与资源所属工作区不一致，可能造成跨工作区授权绕过，任意工作区成员可读取源和目标配置、触发和取消同步、删除连接、源和目标。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
airbytehq airbyte-platform 0 ~ 2.0.0 -

II. Public POCs for CVE-2026-80049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9228 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-80049

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80049 (1)

Other References for CVE-2026-80049 (2)

IV. Related Vulnerabilities

Same vendor: airbytehq
Same weakness: CWE-639

V. Comments for CVE-2026-80049

No comments yet

Leave a comment