1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. Airbyte concentrates risk in its connector execution surface where authenticated code execution has been demonstrated, while audit logging and input filtering remain absent from the default configuration.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Airbyte sits in the Exposed Giants quadrant with connector-builder code execution as the dominant risk driver and pod isolation plus access controls as the primary mitigating factors.
Attack surface at the upper-medium band and blast radius below the high threshold place Airbyte in the Exposed Giants quadrant, where confirmed exploitation exists but containment architecture partially bounds the damage.
Each axis measures a different dimension of risk: attack surface and blast radius scale to ten, defense controls sum to fifteen, and AIRQ composites all three into a single operator-facing score.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 4.68 | Moderate composite driven by confirmed RCE in the connector-builder component offset by Kubernetes pod isolation and workspace access-control defaults. |
| Blast Radius | 5.5 / 10 | Credential access and unrestricted outbound connectivity drive the blast radius above the midpoint. |
| Attack Surface | 5.4 / 10 | Connector-builder exploitation anchors the upper band while remaining surfaces stay at moderate architectural exposure. |
| Defense Controls | 5 / 15 | Pod isolation and workspace RBAC provide containment and access control; operators should prioritize enabling audit logging and restricting connector-builder access to close the remaining gaps. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The dominant exposures for Airbyte are its connector-builder code execution surface, the unvalidated community marketplace, and the broad data ingestion path through hundreds of connectors.
One surface reaches the adjusted ceiling through a confirmed CVE while four others score at the moderate-risk band from architectural exposure alone.
Each row ties a scored attack surface to the strongest agent-specific evidence anchor and an analyst assessment of the documented exposure.
| Surface | Score | Comments |
|---|---|---|
| User Input | 2 / 4 | Authenticated input channels with schema validation for connector configurations; AI Assistant accepts natural language within workspace-scoped session context configurable via RBAC role assignments. [11] |
| External Data | 3 / 4 | Connector-builder-server processes untrusted serialized data from LangChain dependency chain with CVE-2025-68664 confirming injection viability. [3] |
| Memory | 2 / 4 | Context Store indexes connector data with operator-configured scope; no automated cross-session learning or integrity verification gaps documented. [11] |
| Reasoning | 2 / 4 | Agent reasoning constrained to connector operations within workspace scope with visible execution traces in connection logs. [7] |
| Planning | 2 / 4 | Sync scheduling and automations follow operator-defined configurations with no autonomous scope expansion documented. [8] |
| Tool Execution | 5 / 4 | CVE-2024-38363 proved authenticated RCE via server-side template injection in the connector-builder docker image with credential exposure impact. [1][2] |
| Orchestration | 3 / 4 | Workload-launcher spawns connector pods on schedule with temporal-based orchestration; multiple component vulnerabilities reported across the orchestration stack. [3][15] |
| Inter-Agent | 2 / 4 | MCP server authenticates via workspace credentials with connector-level isolation between requesting agents. [11] |
| Output Processing | 1 / 4 | Data output flows to configured destinations with credential isolation via secrets manager; no rich rendering or exfiltration channels documented. [5] |
| Configuration | 3 / 4 | Community marketplace connectors execute as Docker images without vendor security vetting; dependency-chain vulnerabilities affect the builder configuration layer. [3][12] |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Airbyte ingests data from hundreds of third-party sources, holds credentials and customer records in its secrets store and Context Store, and transmits data to external destinations and agent clients through unrestricted outbound channels.
Airbyte exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Connector data sources and community marketplace deliver untrusted content into the platform processing pipeline without content-level validation. [12]
- Sensitive data — OAuth tokens, API keys, and database passwords stored in secrets managers grant access to enterprise customer records and production data stores. [5]
- External egress — Connector operations and Agent direct execution send data to external destinations and third-party APIs through unrestricted outbound HTTP. [7]
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. Compromise of the connector execution layer grants access to stored credentials and unrestricted outbound connectivity to all configured data destinations.
Two factors reach the upper band through credential and network access while code execution and file system remain contained by pod isolation.
Each row maps a blast-radius factor to the documented default capability the platform grants to connector workloads and agent operations.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 2 / 4 | Connector operations run in isolated Kubernetes pods with dedicated lifecycle; the builder component proved exploitable for arbitrary code execution. [1] |
| File system access | 2 / 4 | Pod-scoped filesystem access for connector workloads; logs and state stored in external object storage with separate credentials. [8] |
| Network access | 3 / 4 | Connectors require unrestricted outbound HTTP to reach configured sources and destinations; no Kubernetes network policy restricts pod egress by default per vendor architecture documentation. [3] |
| Credential access | 3 / 4 | Platform stores OAuth tokens, API keys, and database passwords for all configured connectors; CVE-2025-68664 vulnerability class enables potential credential extraction from the connector-builder-server environment. [3] |
| Autonomous action | 2 / 4 | Scheduled syncs execute data operations against production systems on operator-configured cadence with workspace-scoped access; no autonomous scope expansion beyond the configured connections documented. [8] |
| Deployment access | 1 / 4 | Data writes to production warehouses and SaaS destinations; no infrastructure modification or package publishing capabilities. [7] |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. Kubernetes pod isolation and workspace RBAC ship as default controls while input filtering, output guardrails, and audit logging require additional licensing or explicit configuration. [6][13][14]
Higher scores indicate stronger vendor-implemented safeguards; Airbyte concentrates its defense in execution isolation and access control with gaps at the input and output layers.
Each component scores the vendor-implemented default control posture independent of operator-managed hardening available at higher license tiers.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 0 / 3 | No prompt shield, injection detection, or content filtering documented for AI Assistant, Agent, or connector data inputs. [5] |
| Execution Isolation | 2 / 3 | Kubernetes pod isolation with dedicated connector lifecycle; cloud deployment uses isolated pods and data plane separation in Enterprise Flex tier. [8] |
| Action Controls | 2 / 3 | RBAC with organization and workspace-level roles enforces least-privilege access; no single-step bypass or auto-approval mechanism documented. [9] |
| Output Guardrails | 0 / 3 | No DLP, credential redaction, or exfiltration blocking documented for data output or Agent API responses. [5] |
| Monitoring | 1 / 3 | Audit logging requires Enterprise tier and server.auditLoggingEnabled in Helm configuration; connection-level sync logs available by default without structured security alerting. [10] |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize enabling audit logging, restricting connector-builder access, and implementing network policies to contain the documented execution and credential risks.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Restrict connector-builder access to authorized developers only through workspace RBAC role assignments — counters unvalidated input reaching the execution surface.
- Configuration Enable workspace-level permission restrictions limiting who can create or modify connector configurations — counters External Data ingestion from untrusted sources.
- Engineering Deploy a prompt-injection detection layer at the Airbyte Agent MCP server and direct-execution API request paths to intercept adversarial content before it reaches the LLM reasoning loop — counters absence of input filtering at the AI interface.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Require security review for all custom and marketplace connector deployments before production use — counters community connector execution without vetting.
- Configuration Configure Kubernetes network policies restricting connector pod egress to only required destination endpoints — counters unrestricted outbound from execution pods.
- Engineering Implement runtime security monitoring with Falco or equivalent on connector pods to detect anomalous execution patterns — counters Execution Isolation gaps post-compromise.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Require separate approval workflows for connection creation versus scheduled sync activation — counters autonomous action firing without per-operation review.
- Configuration Configure workspace role assignments to separate connector administration from sync execution privileges — counters credential access concentration.
- Engineering Build webhook-based approval gates that require external sign-off before high-privilege connector operations execute — counters Action Controls at default scope.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Classify connected destinations by data sensitivity tier and require additional approval for high-sensitivity writes — counters output flowing without DLP controls.
- Configuration Enable log scrubbing in the Helm configuration to redact credentials from technical logs before persistence — counters sensitive data appearing in log output.
- Engineering Implement a data-loss-prevention proxy between Airbyte and external destinations to detect credential or PII leakage in transit — counters Output Guardrails at zero.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require audit logging enablement as a deployment prerequisite in organizational security policy — counters Monitoring at default-off posture.
- Configuration Enable audit logging via server.auditLoggingEnabled in the Helm values.yaml and configure external blob storage for log persistence — counters silent operation on self-managed deployments.
- Engineering Forward OpenTelemetry metrics from the Airbyte /metrics endpoint to a SIEM with alerting rules for failed authentication, unusual sync patterns, and credential access anomalies — counters Monitoring without active detection.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- CVE-2024-38363 RCE via SSTI in connection-builder docker image (CVSS 8.5). Authenticated attacker executes arbitrary code as web server user and exposes stored credentials. Patched in 0.62.2.
- GHSA-4j3c-fgvx-xgqq GitHub Security Advisory confirming SSTI vulnerability in Airbyte connection builder with CVSS 8.5 severity and remediation guidance for versions prior to 0.62.2.
- CVE-2025-68664 in Airbyte LangChain serialization injection affecting connector-builder-server dependency with potential for credential extraction and code execution via Jinja2 templates.
Selected Research
- Airbyte Agent Data Security Patterns Vendor guidance on securing AI agent data connections including permission-aware retrieval and authorization bypass prevention patterns.
Vendor Documentation
- Airbyte Security Practices Platform security documentation covering encryption and credential storage and pod isolation and compliance certifications for Cloud and self-managed deployments.
- Airbyte Trust Center Centralized trust documentation providing access to SOC 2 Type II reports and ISO 27001 certificate and real-time security control status.
- Airbyte Architecture Overview Technical architecture documentation describing the microservices platform and connector isolation model and workload launcher and Kubernetes deployment topology.
- Airbyte Enterprise Implementation Guide Self-managed Enterprise deployment guide covering Kubernetes requirements and secrets management and external storage configuration.
- Airbyte RBAC Documentation Role-based access control documentation defining organization and workspace-level permission types with least-privilege assignment guidance.
- Airbyte Audit Logging Enterprise audit logging documentation covering event types and blob storage configuration and JSON log format for compliance investigations.
- Airbyte Agents Overview Airbyte Agents platform documentation covering Context Store and direct and search execution modes and MCP server and multi-interface credential management.
- Airbyte Connector Support Levels Connector tier documentation distinguishing vendor-maintained connectors from community marketplace connectors that carry no support SLAs.
Other Sources
- Airbyte SOC 2 Type II Announcement Independent verification confirming Airbyte completed SOC 2 Type 2 audit by Johanson Group covering security and availability and confidentiality.
- Airbyte ISO 27001 Certification Certification announcement confirming ISO 27001:2017 from the British Assessment Bureau covering the Airbyte Cloud information security management system.
- Airbyte Orchestration Component Vulnerabilities GitHub issue documenting multiple high-severity vulnerabilities across workload-launcher and cron and temporal orchestration components in Airbyte platform v1.7.2.