(0Day) Airbyte OneDrive Connector _get_shared_drive_object SSRF Information Disclosure (CVE‑2026‑92204)
What It Is — A server‑side request forgery (SSRF) flaw in Airbyte’s OneDrive connector allows an authenticated remote attacker to force the connector to issue arbitrary HTTP requests. The vulnerability stems from insufficient validation of the URI passed to the _get_shared_drive_object method, leading to potential information disclosure of the service‑account context.
Exploitability — CVSS 7.7 (High). An attacker with valid Airbyte credentials can trigger the flaw; no public exploit code is known, but the attack vector is network‑remote and requires low effort.
Affected Products — Airbyte open‑source data‑integration platform, specifically the OneDrive connector component.
Why It Matters for Trust & Control Assurance
- Highlights the need for input‑validation controls and network‑egress monitoring across third‑party connectors, a control objective that maps to many frameworks (e.g., NIST CSF Identify → Protect).
- Demonstrates how a single mis‑validated URI can break the defensible audit trail for data‑flow evidence, undermining continuous‑monitoring programs.
- Provides a concrete case for control‑mapping: organizations must evidence that they have validated data‑ingress points and can produce logs showing outbound request activity.
Recommended Actions
- Apply any patch released by Airbyte immediately; if none is available, disable the OneDrive connector.
- Enforce network‑egress filtering to restrict outbound requests from Airbyte instances to known destinations.
- Add runtime validation of all URIs supplied to connector methods and log each outbound request with correlation IDs.
- Update your control‑mapping inventory to include “Validate external request parameters” and capture evidence in your Trust Center.
- Conduct a focused audit of all third‑party connectors for similar SSRF‑prone patterns.