JPCERT/CC: critical Airbyte code-execution flaw is being exploited in the wild; self-managed Airbyte before 2.2.0 must upgrade
- Fix: upgrade to Airbyte 2.2.0 or later (ships manifest-server / airbyte-cdk 7.23.7). Airbyte 1.x will not be patched.
- If you can't upgrade yet (per Airbyte): make the Connector Builder / Manifest Server reachable only from the Airbyte server, and limit Workspace Reader and Organization Reader roles to trusted users.
- Assume exposure if it was reachable: Airbyte containers hold credentials for the databases, APIs and warehouses it syncs. If an unpatched instance was reachable by untrusted users or networks, review container logs and rotate the connection secrets it holds.
- Not public: JPCERT/CC hasn't named attackers, victim counts or indicators.
Sources: JPCERT/CC JVN#12040144: Airbyte vulnerable to arbitrary code execution (Nov 4) · Airbyte advisory GHSA-g35w-6r6v-h4r7