Airbyte OneDrive Zero-Day: CVE-2026-92204 Remains Unpatched After 10 Months

On September 16, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-704, documenting a Server-Side Request Forgery vulnerability in Airbyte's OneDrive connector. The flaw, tracked as CVE-2026-92204 with a CVSS 7.7 score, allows an authenticated remote attacker to force arbitrary HTTP requests from the server and extract information in the context of the service account. ZDI waited nearly 11 months from the initial report before releasing technical details.

The Flaw: Unvalidated URI in the _get_shared_drive_object Method

ZDI pinpoints the exact failure point. According to the advisory, "the specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources." The OneDrive connector accepts user input defining the resource to contact and forwards it via HTTP request without verifying the final destination.

An authenticated attacker who controls the URI parameter can direct the request toward internal endpoints. The response is returned to the malicious user, enabling information disclosure in the context of the service account. "This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte," ZDI notes. "Authentication is required to exploit this vulnerability."

The combination of SSRF with information disclosure is particularly relevant in data integration platforms, where the service account typically holds extensive privileges to read and synchronize datasets across disparate sources. The ability to force server-side requests opens scenarios for internal network scanning, cloud metadata access, and potential chaining with other vulnerabilities in the perimeter.

The Silence Timeline: From October 2025 to September 2026

ZDI documented a coordinated disclosure process that concluded with zero-day publication due to vendor inaction. The vulnerability was reported to Airbyte on October 29, 2025. On February 2, 2026, the ZDI team performed a formal follow-up requesting confirmation of receipt. On March 30, 2026, ZDI notified its intent to proceed with publication as a zero-day advisory.

The final release date of September 16, 2026 places disclosure at roughly 10 and a half months from the initial report. This interval exceeds the typical vulnerability-to-patch coordination cycle, which in standard industry practice ranges from 90 to 120 days for actively maintained open-source software.

The source does not specify the reasons for the failure to release a fix, nor whether Airbyte has since published corrective updates. The absence of a documented patch at the time of disclosure represents the determining factor in ZDI's decision to publish with zero-day status.

"An attacker can leverage this vulnerability to disclose information in the context of the service account." — ZDI Advisory ZDI-26-704

Open-Source Context and Connector Governance

Airbyte operates in the data synchronization segment across cloud storage, data warehouses, and SaaS applications. The open-source model distributes security response responsibility between the core team and contributors of individual connectors. Advisory ZDI-26-704 specifically concerns the OneDrive connector, the component that integrates the platform with the Microsoft 365 ecosystem.

The CVSS 7.7 places the vulnerability in the upper severity tier, nearing the 8.0 threshold that defines critical severity. The combination of remote access, required authentication, and confidentiality impact justifies this positioning. The attack vector favors low complexity: the authenticated attacker requires no special conditions or additional user interaction.

The source documents no in-the-wild exploitation or infrastructure overlap with known campaigns. The nature of the flaw — SSRF in a specific connector — limits the attack surface compared to vulnerabilities in the platform core, but does not eliminate risk for environments actively using OneDrive synchronization.

What to Do Now

The primary source documents a single action for environments using Airbyte's OneDrive connector:

• Restrict interaction with the product, given the absence of patches or applicable user-side technical countermeasures.

ZDI states explicitly: "Given the nature of the vulnerability, the only salient mitigation strategy is to restrict interaction with the product." This translates operationally to temporarily disabling the OneDrive connector, limiting accounts with access to the functionality, or migrating to alternative Microsoft 365 integration solutions until a corrective update is released.

The source specifies no further operational actions, affected versions, or timelines for a potential fix. System administrators must assess the risk profile based on the connector's actual exposure in their environment and the sensitivity of data managed by the service account.

Source Verification and Limitations

Information is verified against the primary ZDI-26-704 advisory. No independent sources of technical confirmation are available. Advisory ZDI-26-703 for the SharePoint connector exists as a separate advisory in ZDI's published list, but this dossier does not treat it as an extended pattern beyond existential acknowledgment.

The public technical detail does not include sample payloads, specific URIs, or affected connector versions. This limitation aligns with ZDI's zero-day disclosure practice, which balances the need to inform users with reducing the risk of immediate automated exploitation.

Sources

• ZDI Advisory ZDI-26-704 — complete primary advisory with CVE, CVSS, technical details, and timeline
• ZDI Published Advisories List — existential confirmation of ZDI-CAN-28216/CVE-2026-92204 with same CVSS and date

Information verified against cited sources and current as of publication.

Sources

• http://www.zerodayinitiative.com/advisories/ZDI-26-704/
• http://www.zerodayinitiative.com/advisories/published/