Snowflake

8 results · Clear filters · Feed

• Medium 6.6
  CVE-2026-121925

  Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver

  A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected drivers may have copied a va…

  Snowflake Snowflake PHP PDO Driver Snowflake Libsnowflakeclient
  Nov 4, 2026
• Medium 6.5
  CVE-2026-114456

  Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

  Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the ident…

  Snowflake Snowflake Connector for Python Snowflake PHP PDO Driver Snowflake JDBC Driver (FIPS)
  Nov 4, 2026
• Medium 6.5
  CVE-2026-86597

  Sensitive information written to logs by Snowflake drivers

  Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic…

  Snowflake Snowflake Connector for Python Snowflake JDBC Driver (FIPS) Snowflake PHP PDO Driver npm Maven PyPI Go
  Sep 8, 2026
• Medium 5.3
  CVE-2026-85528

  Snowflake JDBC Driver auto-configuration account validation permits credential redirection

  Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the ac…

  Snowflake Snowflake JDBC Driver Snowflake JDBC Driver (Thin) Snowflake JDBC Driver (FIPS)
  Sep 4, 2026
• Medium 6.0
  CVE-2026-13752

  Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands

  Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the cont…

  Snowflake Snowflake CLI
  Jun 29, 2026
• Medium 4.1
  CVE-2026-13751

  Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load

  Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient res…

  Snowflake Snowflake CLI
  Jun 29, 2026
• Medium 5.5
  CVE-2026-13750

  Snowflake CLI Sensitive Credential Exposure Through Debug Logging

  Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log file…

  Snowflake Snowflake CLI
  Jun 29, 2026
• Medium 6.3
  CVE-2026-13748

  Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

  Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that …

  Snowflake Snowflake CLI
  Jun 29, 2026