EUVD-2026-57071
GHSA-qfpg-v669-8p3h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Network vector applies because exploitation routes through a downstream app interface; PR:L reflects mandatory low-privileged application access; no confidentiality impact documented; integrity and availability both high due to unauthorized Snowflake object manipulation.
Primary rating from Vendor (SNOWFLAKE).
CVSS VectorVendor: SNOWFLAKE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Insufficient input sanitization in Snowflake Python API (snowflake.core) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded .. identifier path segments, and HTTP parameter pollution (CWE-141) via unencoded &/#/= characters in query string values. An attacker with access to a downstream application built on snowflake.core could exploit the path traversal by supplying .. as an object name, causing snowflake.core to issue REST requests against a parent resource or exploit the parameter pollution by injecting &/#/= into a free-form name field to override constraints on swap, clone, or rename operations - all executed under the application's privileged session. Successful exploitation requires the attacker to control an identifier or object-name string in an application built on snowflake.core that passes it to snowflake.core under a higher-privileged Snowflake session (e.g., an EXECUTE AS OWNER stored procedure, Streamlit app, or Native App). The fix is available in Snowflake Python API version 1.13.0, which also addresses several additional security findings. Users must manually upgrade.
Articles & Coverage 2
AnalysisAI
Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded .. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to hold simultaneously: (1) the target application must be built on `snowflake.core` versions prior to 1.13.0; (2) the application must accept user-influenced input - specifically object names or identifier strings - and pass that input unsanitized to snowflake.core API calls; (3) those API calls must execute under a Snowflake session with elevated privileges, specifically deployment patterns such as an EXECUTE AS OWNER stored procedure, a Streamlit app running under a privileged role, or a Snowflake Native App; and (4) the attacker must hold at least low-privileged access to the downstream application (CVSS PR:L), meaning they can interact with its input interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-calibrated: the network attack vector is correct because the attacker interacts through a downstream application interface rather than Snowflake directly, and PR:L reflects the gating requirement of authenticated or recognized access to that application. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with low-privileged access to a Streamlit app or Native App built on snowflake.core submits an object name containing `..` or characters such as `&target=privileged_object` into a field used for a clone or rename operation. The unpatched library embeds this input directly into the REST request URL or query string, causing Snowflake's backend to apply the operation to an unintended resource - all executed under the application's EXECUTE AS OWNER privileged session. … |
| Remediation | Upgrade `snowflake.core` to version 1.13.0 immediately, as this release contains Snowflake's fix for both the path traversal and HTTP parameter pollution weaknesses, along with additional security improvements disclosed by the vendor. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory all systems running snowflake.core prior to version 1.13.0 and document which business-critical applications depend on this library. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing
Same weakness CWE-22 – Path Traversal
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today