Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-80049— Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId

Quick assessment

Affected
airbytehq airbyte-platform
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Airbyte 平台在处理授权决策时，从调用者提供的某个字段中解析工作区（workspace）。 会将已识别的标识符从原始 JSON 请求体中复制并放入 请求头中；而 在评估任何基于资源的请求头（包括连接、源和目的地的标识符）之前，会优先查阅 头。 尽管某些端点在其声明的请求体中仅包含资源标识符，但由于提取器直接读取请求体而非端点的 OpenAPI /schema 定义，因此这些请求仍会附带一个 字段。这导致权限检查是基于调用者指定的工作区进行的，而实际处理操作却基于调用者提供的资源标识符。此后，系统并未将该资源的

CVSS 8.8 · High EPSS 0.34% · P27

Possible ATT&CK Techniques 1 AI

T1078 · Valid Accounts

Affected Version Matrix 1

VendorProduct Version RangeStatus
airbytehq airbyte-platform ≤ 2.0.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceId
Source: CVE Program / CVE List V5
Vulnerability Description
Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id ahead of every resource-derived header, including those for connection, source and destination identifiers. Endpoints whose declared request bodies carry only a resource identifier are nonetheless reached with an added workspaceId field, because the extractor reads the body rather than the endpoint's schema, so the permission check is performed against the workspace the caller nominated while the handler acts on the resource identifier the caller supplied. Nothing afterwards compares the resource's owning workspace with the one that was authorized. A member of any workspace can therefore read source and destination configuration, trigger and cancel syncs, and delete connections, sources and destinations that belong to workspaces they have no access to, at whatever privilege level their own workspace membership grants them.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
airbytehq airbyte-platform 0 ~ 2.0.0 -

II. Public POCs for CVE-2026-80049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
Qwen3.6-35B-A3B · 9228 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-80049

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-80049 (1)

Other References for CVE-2026-80049 (2)

IV. Related Vulnerabilities

Same vendor: airbytehq
Same weakness: CWE-639

V. Comments for CVE-2026-80049

No comments yet

Leave a comment