Description
The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Grafana | Snowflake Datasource | 1.14.7 – ≤ 1.14.12 | — |
Advisories 1
- WID-SEC-2026-2414 Grafana: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jul 19, 2026
References
- https://grafana.com/security/security-advisories/cve-2026-28381 vendor-advisory