Snowflake Datasource
Monthly
Arbitrary file read and write in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) allows authenticated users with query permissions to invoke Snowflake GET/PUT commands and transfer files between the Grafana server's local filesystem and the connected Snowflake host. The CVSS 9.6 score reflects a scope-changing flaw (S:C) where low-privileged datasource users can pivot beyond the plugin's intended trust boundary; no public exploit identified at time of analysis.
Arbitrary file read and write in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) allows authenticated users with query permissions to invoke Snowflake GET/PUT commands and transfer files between the Grafana server's local filesystem and the connected Snowflake host. The CVSS 9.6 score reflects a scope-changing flaw (S:C) where low-privileged datasource users can pivot beyond the plugin's intended trust boundary; no public exploit identified at time of analysis.