This flaw in the OneDrive Connector’s _get_shared_drive_object method allows authenticated users to craft a URI that causes the Airbyte server to unconditionally issue a request to that URI. The lack of validation means arbitrary network endpoints can be contacted and data returned by those endpoints will be visible to the attacker through the service account’s context, effectively leaking sensitive information. The weakness corresponds to CWE‑918, which enables unauthorized remote data disclosure.

Airbyte’s OneDrive Connector is affected; the vendor is Airbyte. No specific product versions were released in this advisory, so any installation that has not applied a recent patch may be vulnerable.

The vulnerability carries a CVSS score of 7.7, indicating a high‑severity information‑disclosure risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, which suggests no known widespread exploitation yet. However, authentication is required, limiting the threat to users with valid Airbyte credentials, and the attacker would need to direct the server to an external endpoint of their choosing.