Snowflake Datasource
Monthly
Improper access control in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) lets any user permitted to run queries against the data source invoke Snowflake GET/PUT commands to read and write files between the local Grafana server and the connected Snowflake host. The flaw effectively turns query permissions into a file-transfer primitive that crosses the trust boundary between the Grafana host and Snowflake. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC marks exploitation as none, but the technical impact is rated total.
Improper access control in the Grafana Snowflake datasource plugin (versions 1.14.7 through 1.14.12) lets any user permitted to run queries against the data source invoke Snowflake GET/PUT commands to read and write files between the local Grafana server and the connected Snowflake host. The flaw effectively turns query permissions into a file-transfer primitive that crosses the trust boundary between the Grafana host and Snowflake. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC marks exploitation as none, but the technical impact is rated total.