Is CVE-2026-80049 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-80049 being exploited in the wild.

How severe is CVE-2026-80049?

High severity, with a CVSS score of 8.8, published 25 August 2026.

Which products and versions are affected?

Airbyte Platform v2.0.0 and likely earlier versions.

Is there a fix for CVE-2026-80049?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-80049 attacked?

It is attacked over the network.

Am I affected by CVE-2026-80049?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-80049: Airbyte Platform workspace authorization bypass

CVE-2026-80049 · Severity: high · CVSS 8.8 · Published 2026-08-25

Airbyte Platform is a data integration platform that manages connections and syncs between data sources and destinations. This vulnerability allows members of one workspace to gain unauthorized access to resources (connections, sources, destinations) in other workspaces by manipulating request parameters. An attacker can read sensitive configuration data, trigger or cancel syncs, and delete resources across workspaces without proper authorization.

Quick answers

Is CVE-2026-80049 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-80049 being exploited in the wild.
How severe is CVE-2026-80049?: High severity, with a CVSS score of 8.8, published 25 August 2026.
Which products and versions are affected?: Airbyte Platform v2.0.0 and likely earlier versions.
Is there a fix for CVE-2026-80049?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-80049 attacked?: It is attacked over the network.
Am I affected by CVE-2026-80049?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass in the AuthenticationHeaderResolver component, which resolves the workspace used for authorization decisions based on a caller-supplied X-Airbyte-Workspace-Id header rather than deriving it from the actual resource being accessed. The AuthorizationServerHandler extracts workspace identifiers from the JSON request body and injects them into headers, but the permission check uses the caller's nominated workspace instead of verifying that the resource actually belongs to that workspace. Endpoints can be reached with an attacker-supplied workspaceId field that bypasses the declared request schema validation. The vulnerability requires network access to the Airbyte API and can be exploited by any authenticated workspace member, allowing them to perform operations on resources in other workspaces without proper access control. No patch availability information is provided in the advisory.

Affected products

Airbyte Platform v2.0.0 and likely earlier versions

Timeline

2026-08-25: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.