https://vulnogram.org/ Most recent CVEs assigned by snowflake (snowflake). https://vulnogram.org/seaview/icons/snowflake.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-92903 https://vulnogram.org/CVE-2026-92903 Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project con… High Thu, 17 Sep 2026 10:49:59 GMT https://vulnogram.org/CVE-2026-86600 https://vulnogram.org/CVE-2026-86600 In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connectio… High Tue, 08 Sep 2026 15:48:45 GMT https://vulnogram.org/CVE-2026-86597 https://vulnogram.org/CVE-2026-86597 Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to d… Medium Tue, 08 Sep 2026 08:24:15 GMT https://vulnogram.org/CVE-2026-85528 https://vulnogram.org/CVE-2026-85528 Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to contr… Medium Fri, 04 Sep 2026 08:36:28 GMT https://vulnogram.org/CVE-2026-85525 https://vulnogram.org/CVE-2026-85525 Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verif… High Network Exploitable Fri, 04 Sep 2026 08:22:43 GMT https://vulnogram.org/CVE-2026-19594 https://vulnogram.org/CVE-2026-19594 Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path segments, and… High Wed, 12 Aug 2026 05:22:07 GMT https://vulnogram.org/CVE-2026-16870 https://vulnogram.org/CVE-2026-16870 Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a vi… High Fri, 24 Jul 2026 04:40:41 GMT https://vulnogram.org/CVE-2026-15925 https://vulnogram.org/CVE-2026-15925 Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker w… Critical Network Exploitable Thu, 16 Jul 2026 05:31:35 GMT https://vulnogram.org/CVE-2026-15736 https://vulnogram.org/CVE-2026-15736 Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker… High Tue, 14 Jul 2026 14:11:31 GMT https://vulnogram.org/CVE-2026-15183 https://vulnogram.org/CVE-2026-15183 Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect CO… Critical Network Exploitable Tue, 14 Jul 2026 08:42:38 GMT https://vulnogram.org/CVE-2026-15067 https://vulnogram.org/CVE-2026-15067 Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, po… High Wed, 08 Jul 2026 14:43:32 GMT https://vulnogram.org/CVE-2026-15062 https://vulnogram.org/CVE-2026-15062 SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabiliti… Critical Wed, 08 Jul 2026 14:32:12 GMT https://vulnogram.org/CVE-2026-13752 https://vulnogram.org/CVE-2026-13752 Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in… Medium Mon, 29 Jun 2026 16:24:03 GMT https://vulnogram.org/CVE-2026-13751 https://vulnogram.org/CVE-2026-13751 Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without suffi… Medium Mon, 29 Jun 2026 16:12:51 GMT https://vulnogram.org/CVE-2026-13750 https://vulnogram.org/CVE-2026-13750 Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local… Medium Mon, 29 Jun 2026 16:07:50 GMT https://vulnogram.org/CVE-2026-13749 https://vulnogram.org/CVE-2026-13749 Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted pro… High Network Exploitable Mon, 29 Jun 2026 16:02:47 GMT https://vulnogram.org/CVE-2026-13748 https://vulnogram.org/CVE-2026-13748 Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project cont… Medium Mon, 29 Jun 2026 15:58:00 GMT https://vulnogram.org/CVE-2026-13746 https://vulnogram.org/CVE-2026-13746 Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Sn… Low Mon, 29 Jun 2026 15:51:57 GMT https://vulnogram.org/CVE-2026-13744 https://vulnogram.org/CVE-2026-13744 Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could… High Network Exploitable Mon, 29 Jun 2026 15:40:47 GMT https://vulnogram.org/CVE-2026-6442 https://vulnogram.org/CVE-2026-6442 Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attacker could exploit this by embedding specially crafted commands in untrusted content, such a… High Network Exploitable Thu, 16 Apr 2026 18:43:21 GMT