SNOWFLAKE

Latest CVEs · RSS

• CVE-2026-92903 2026-09-17 · CVSS 8.2
  Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are exec
• CVE-2026-86600 2026-09-08 · CVSS 8.2
  In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying
• CVE-2026-86597 2026-09-08 · CVSS 6.5
  Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-res
• CVE-2026-85528 2026-09-04 · CVSS 5.3
  Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login
• CVE-2026-85525 2026-09-04 · CVSS 7.4
  Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP
• CVE-2026-19594 2026-08-12 · CVSS 8.1
  Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two rel
• CVE-2026-16870 2026-07-24 · CVSS 8.8
  Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack
• CVE-2026-15925 2026-07-16 · CVSS 9.2
  Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass
• CVE-2026-15736 2026-07-14 · CVSS 8.3
  Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merg
• CVE-2026-15183 2026-07-14 · CVSS 9.2
  Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth cli
• CVE-2026-15067 2026-07-08 · CVSS 8.8
  Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input cou
• CVE-2026-15062 2026-07-08 · CVSS 9.6
  SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to e
• CVE-2026-13752 2026-06-29 · CVSS 6.0
  Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying craf
• CVE-2026-13751 2026-06-29 · CVSS 4.1
  Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source
• CVE-2026-13750 2026-06-29 · CVSS 5.5
  Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug
• CVE-2026-13749 2026-06-29 · CVSS 8.8
  Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during a
• CVE-2026-13748 2026-06-29 · CVSS 6.3
  Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflak
• CVE-2026-13746 2026-06-29 · CVSS 3.6
  Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by sup
• CVE-2026-13744 2026-06-29 · CVSS 8.3
  Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository
• CVE-2026-6442 2026-04-16 · CVSS 8.3
  Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attack