EUVD-2026-38244
GHSA-v3c5-p4mq-9369
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network query interface (AV:N/AC:L) but a query-capable authenticated account is required (PR:L); file read and write yield C:H/I:H with no availability impact (A:N).
Primary rating from Vendor (GRAFANA).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.
Articles & Coverage 1
AnalysisAI
Improper access control in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) lets any user permitted to run queries against the data source invoke Snowflake GET/PUT commands to read and write files between the local Grafana server and the connected Snowflake host. The flaw effectively turns query permissions into a file-transfer primitive that crosses the trust boundary between the Grafana host and Snowflake. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC marks exploitation as none, but the technical impact is rated total.
Technical ContextAI
Grafana data source plugins expose third-party backends (here, Snowflake) to dashboard users through a query interface. Snowflake's SQL surface includes the GET and PUT staging commands, which move files between a client's local filesystem and Snowflake internal/named stages. Because the plugin runs inside the Grafana server backend, those commands operate against the Grafana host's filesystem rather than the end user's machine. CWE-284 (Improper Access Control) is the root-cause class: the plugin fails to restrict which Snowflake commands a query-capable user may run, so file-system-touching GET/PUT operations are not gated separately from ordinary read-only SELECT queries. The affected component is identified by CPE cpe:2.3:a:grafana:snowflake_datasource:*:*:*:*:*:*:*:* - the standalone Snowflake datasource plugin, not Grafana core.
RemediationAI
Patch available per vendor advisory: upgrade the Snowflake datasource plugin to a release newer than 1.14.12 as directed by the Grafana security advisory at https://grafana.com/security/security-advisories/cve-2026-28381 (the exact fixed version is not stated in the provided data, so confirm it against that advisory before deploying). As compensating controls until patched, restrict who can query the Snowflake data source by tightening Grafana data source and dashboard/Explore permissions so only trusted users hold query rights (trade-off: reduces self-service analytics for ordinary users). Where supported, scope the Snowflake service account used by the plugin with least privilege and deny it stage GET/PUT capability so file-transfer commands fail server-side (trade-off: breaks any legitimate workflow relying on Snowflake staging). Additionally, audit query logs for unexpected GET/PUT statements and run the Grafana server as an unprivileged user on a hardened filesystem to limit what a successful read/write can reach.
The `Release PR Merged` workflow in the github repo taosdata/grafanaplugin is subject to a command injection vulnerabili
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
A signature verification vulnerability exists in crewjam/saml. Rated critical severity (CVSS 9.8), this vulnerability is
Grafana 2.x, 3.x, and 4.x before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generat
The SQL Expressions experimental feature of Grafana allows for the evaluation of `duckdb` queries containing user input.
Authentication bypass in Grafana OnCall through 1.16.11 lets unauthenticated remote attackers mint a valid PluginAuthTok
Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows re
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redire
The avatar feature in Grafana 3.0.1 through 7.0.1 has an SSRF Incorrect Access Control issue. Rated high severity (CVSS
Grafana is an open-source platform for monitoring and observability. Rated high severity (CVSS 7.5), this vulnerability
Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. Rated high severity (
Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. Rated high
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today