EUVD-2026-57071
GHSA-qfpg-v669-8p3h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network vector applies because exploitation routes through a downstream app interface; PR:L reflects mandatory low-privileged application access; no confidentiality impact documented; integrity and availability both high due to unauthorized Snowflake object manipulation.
Primary rating from Vendor (SNOWFLAKE).
CVSS VectorVendor: SNOWFLAKE
Lifecycle Timeline
3DescriptionCVE.org
Insufficient input sanitization in Snowflake Python API (snowflake.core) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded .. identifier path segments, and HTTP parameter pollution (CWE-141) via unencoded &/#/= characters in query string values. An attacker with access to a downstream application built on snowflake.core could exploit the path traversal by supplying .. as an object name, causing snowflake.core to issue REST requests against a parent resource or exploit the parameter pollution by injecting &/#/= into a free-form name field to override constraints on swap, clone, or rename operations - all executed under the application's privileged session. Successful exploitation requires the attacker to control an identifier or object-name string in an application built on snowflake.core that passes it to snowflake.core under a higher-privileged Snowflake session (e.g., an EXECUTE AS OWNER stored procedure, Streamlit app, or Native App). The fix is available in Snowflake Python API version 1.13.0, which also addresses several additional security findings. Users must manually upgrade.
Articles & Coverage 2
AnalysisAI
Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded .. segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected &, #, or = characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade.
Technical ContextAI
The Snowflake Python API package (snowflake.core) constructs REST API requests to Snowflake's backend by embedding object identifiers and free-form name strings supplied by calling applications directly into URL paths and query strings. Prior to 1.13.0, these inputs were not sanitized before construction. CWE-22 (Path Traversal) applies to the URL-path dimension: unencoded .. sequences in an identifier cause the constructed REST path to traverse upward, targeting a parent resource rather than the intended one. CWE-141 (Improper Neutralization of Parameter/Argument Delimiters) applies to the query-string dimension: &, #, and = characters in free-form name fields inject additional query parameters or fragment identifiers, overriding server-side constraints on sensitive Snowflake operations. Both weaknesses operate as a confused-deputy attack - the library holds elevated credentials and acts on behalf of a privileged session, making it the deputy whose authority an attacker subverts by controlling its inputs. Affected product scope is identified via CPE cpe:2.3:a:snowflake:snowflake_python_apis:*:*:*:*:*:*:*:*, covering all versions of the package prior to 1.13.0.
RemediationAI
Upgrade snowflake.core to version 1.13.0 immediately, as this release contains Snowflake's fix for both the path traversal and HTTP parameter pollution weaknesses, along with additional security improvements disclosed by the vendor. The patched package is available at https://pypi.org/project/snowflake.core/1.13.0/ and must be upgraded manually via pip install 'snowflake.core>=1.13.0' - no automatic update mechanism is noted. If immediate upgrade is not feasible, a compensating control is to validate and reject any user-supplied input containing .., &, #, or = characters at the application layer before passing it to snowflake.core functions; this application-level filtering reduces exposure but is error-prone and not a substitute for the library fix. Separately, auditing all snowflake.core-based applications that execute under EXECUTE AS OWNER stored procedures, Streamlit apps, or Native App contexts to identify and restrict untrusted input paths will further reduce the attack surface until the upgrade is complete.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today