---
id: CVE-2026-92204
title: >-
  Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request
  Forgery Information Disclosure Vulnerability
summary: >-
  Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request
  Forgery Information Disclosure Vulnerability. This vulnerability allows remote
  attackers to initiate arbitrary server-side requests on affected installations
  of Airb…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-918
vendor: Airbyte
product: Airbyte
affected:
  - Airbyte 1.8
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T17:17:14.805Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92204'
references:
  - url: 'https://www.zerodayinitiative.com/advisories/ZDI-26-704/'
    label: ZDI-26-704
tags:
  - cve.org
zeroDay: true
ingestedAt: '2026-10-21T18:09:27.282Z'
---

## Overview

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability.

The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-28216.

## Affected

- `Airbyte 1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.