Grafana Snowflake Datasource EUVD-2026-38244

Exploitation requires that the Snowflake datasource plugin (1.14.7-1.14.12) is installed and configured in Grafana, and that the attacker holds an authenticated Grafana account with permission to run queries against that specific Snowflake data source (CVSS PR:L). The attacker must be able to submit Snowflake GET and/or PUT commands through the query interface - these are the exact features abused. Limiting factors that reduce real-world risk: query access to the data source must already be granted (not default for arbitrary users), the Snowflake datasource plugin must be present (Grafana core alone is not vulnerable), and the Snowflake service account must retain stage file-transfer privileges. No end-user interaction beyond the attacker's own session is needed.

Signals are mixed-to-moderate. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1 High) indicates a network-reachable, low-complexity attack that nonetheless requires authenticated, query-capable access (PR:L) - this is not an unauthenticated path. EPSS is low at 0.23% and CISA SSVC reports Exploitation: none and Automatable: no, consistent with the absence of any public PoC; however SSVC rates Technical Impact as total, aligning with the C:H/I:H file read/write capability. The realistic risk is that of an insider or a compromised low-privileged Grafana account being able to read sensitive files (credentials, configs) from the Grafana host or write/overwrite files - a privilege-escalation and data-exfiltration lever rather than a mass-exploitable internet worm. Net: a genuine concern in environments where many users have query access to a Snowflake data source, but lower urgency where that access is tightly held. The low EPSS and 'none' exploitation status reflect that no exploitation has been observed, not that impact is low.

A low-privileged Grafana user who can run queries against the Snowflake data source crafts a query containing a Snowflake GET command to pull a sensitive file (for example, configuration or credential material) from the Grafana server's local filesystem into a Snowflake stage they control, then exfiltrates it. Alternatively they issue a PUT to write or overwrite a file on the Grafana host. No special tooling or user interaction beyond their own session is required and attack complexity is low, though valid query access is a prerequisite; no public exploit code is currently known.