ZDI-CAN-28216
HIGH 7.7
Overdue
Oct 29, 2025
Airbyte
Airbyte is a popular open-source data integration platform used for ETL/ELT operations. This vulnerability has a CVSS score of 7.7 and can be exploited remotely by an authenticated attacker with low complexity, resulting in high confidentiality impact across multiple systems while preserving system integrity and availability. Security teams should monitor for any suspicious data access or exfiltration activities from Airbyte instances and prioritize patching once the vendor releases a fix before the February 2026 deadline.
Advisory Details
Researcher
Discovered by:
Peter Girnus (@gothburz) and Brandon Niemczyk of Trend Zero Day Initiative
Reported
October 29, 2025
Deadline
February 26, 2026
49d overdue
CVSS Vector
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N