CVE-2026-80049: Airbyte Platform Privilege Escalation

CVE-2026-80049 Overview

CVE-2026-80049 is a broken access control vulnerability in Airbyte Platform through version 2.0.0. The platform resolves the workspace used for authorization decisions from a field the caller supplies in the request body. AuthorizationServerHandler copies recognised identifiers from the raw JSON body into X-Airbyte-* headers, and AuthenticationHeaderResolver.resolveWorkspace consults X-Airbyte-Workspace-Id before any resource-derived header. This allows a member of any workspace to read source and destination configurations, trigger and cancel syncs, and delete connections, sources, and destinations belonging to workspaces they have no legitimate access to.

Critical Impact
Any authenticated Airbyte workspace member can perform cross-tenant read, modify, and delete operations against resources in other workspaces, breaking multi-tenant isolation.

Affected Products

Airbyte Platform through version 2.0.0
airbyte-commons-server module implementing AuthenticationHeaderResolver.kt
Self-hosted and multi-tenant Airbyte deployments relying on workspace-based authorization

Discovery Timeline

2026-08-25 - CVE-2026-80049 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-80049

Vulnerability Analysis

The flaw is an Authorization Bypass Through User-Controlled Key ([CWE-639]) in Airbyte's server-side authorization layer. Airbyte's AuthorizationServerHandler extracts recognised identifiers from the raw JSON request body and copies them into X-Airbyte-* headers. The downstream AuthenticationHeaderResolver.resolveWorkspace prefers X-Airbyte-Workspace-Id over any resource-derived header, including headers derived from connection, source, or destination identifiers.

Because the extractor reads the raw body rather than the endpoint's declared schema, endpoints that only accept a resource identifier still honor an attacker-supplied workspaceId field. The permission check runs against the workspace the caller nominated, while the handler acts on the resource identifier the caller supplied. No later logic compares the resource's owning workspace with the workspace that was authorized.

Root Cause

The authorization pipeline trusts a caller-controlled field as the authoritative subject of the permission check. Resource-derived workspace resolution is skipped whenever X-Airbyte-Workspace-Id is present, so the check and the action reference different workspaces.

Attack Vector

An authenticated user in any workspace crafts an API request that targets a resource identifier belonging to another workspace and injects a workspaceId field pointing at their own workspace. The server authorizes the request against the attacker's own workspace membership and then executes the operation on the foreign resource, granting cross-workspace read, sync control, and deletion at the privilege level of the attacker's own workspace role.

A prose walkthrough and source references are available in the VulnCheck Advisory on Airbyte Platform and the GitHub Airbyte Authentication Header Code.

Detection Methods for CVE-2026-80049

Indicators of Compromise

API requests where the JSON body workspaceId differs from the workspace that owns the referenced connection, source, or destination identifier.
Unexpected X-Airbyte-Workspace-Id header values on endpoints whose declared request bodies do not require a workspace identifier.
Audit log entries showing sync triggers, sync cancellations, or resource deletions performed by users who lack membership in the resource's owning workspace.

Detection Strategies

Correlate the caller's workspace membership at request time against the owning workspace of any connection, source, or destination identifier in the request.
Alert on API calls that reference resource identifiers whose owning workspace does not appear in the caller's workspace membership set.
Baseline per-user API access to specific sourceId, destinationId, and connectionId values, and flag first-time cross-workspace access.

Monitoring Recommendations

Ingest Airbyte server access logs and application audit logs into a central analytics platform for cross-workspace query patterns.
Monitor delete operations on connections, sources, and destinations for spikes tied to individual accounts or service tokens.
Track authentication and workspace membership changes alongside sensitive resource operations to detect abuse.

How to Mitigate CVE-2026-80049

Immediate Actions Required

Restrict network access to the Airbyte API so only trusted internal users and services can reach it while a patched build is deployed.
Review workspace membership and remove accounts that no longer require access, reducing the population of users able to abuse the flaw.
Rotate API tokens and service credentials used against the Airbyte API and audit their recent activity for cross-workspace calls.

Patch Information

Upgrade to a fixed Airbyte Platform release published after version 2.0.0. Refer to the GitHub Airbyte Platform Repository for the latest release and to the VulnCheck Advisory on Airbyte Platform for advisory details.

Workarounds

Deploy an API gateway or reverse proxy that strips client-supplied X-Airbyte-Workspace-Id headers before they reach the Airbyte server.
Filter or reject inbound JSON request bodies that include a workspaceId field on endpoints whose declared schema does not require one.
Segregate tenants across separate Airbyte deployments where strict workspace isolation is required until the patched version is in place.

bash

# Example NGINX snippet to strip caller-supplied workspace headers
location /api/ {
    proxy_set_header X-Airbyte-Workspace-Id "";
    proxy_set_header X-Airbyte-Connection-Id "";
    proxy_set_header X-Airbyte-Source-Id "";
    proxy_set_header X-Airbyte-Destination-Id "";
    proxy_pass http://airbyte_server_upstream;
}