45
CVEs
3
Critical
19
High
0
KEV
2
PoC
0
Unpatched C/H
100.0%
Patch Rate
1.3%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
19
MEDIUM
15
LOW
8
Monthly CVE Trend
Affected Products (26)
Python
13
Snowflake Connector
13
Snowflake Cli
7
Snowflake Jdbc
6
Java
5
Snowflake Jdbc Driver
4
Snowflake Connector For Python
4
macOS
4
Streamlit
4
Snowflake Go Driver
3
Snowflake Node Js Driver
3
Snowflake Odbc Driver
2
Snowflake Libsnowflakeclient
2
Gosnowflake
2
Node.js
2
Connector For C C
2
Snowflake Php Pdo Driver
2
Snowflake Hive Metastore Connector
1
Cortex Code Cli
1
PHP
1
Snowflake Connector For Net
1
Snowflake Python Apis
1
Snowflake Spark Connector
1
Snowflake Sqlalchemy
1
Windows
1
Go
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-19594 | Confused-deputy privilege escalation in snowflake.core (Snowflake Python API) prior to version 1.13.0 enables attackers with low-privileged access to a downstream application to perform unauthorized Snowflake operations under the application's higher-privileged session. Two related input-sanitization weaknesses make this possible: path traversal via unencoded `..` segments in REST URL paths (CWE-22), and HTTP parameter pollution via injected `&`, `#`, or `=` characters in query strings (CWE-141), either of which can subvert swap, clone, or rename operations against unintended resources. No public exploit code has been identified at time of analysis and no CISA KEV listing is confirmed; the vendor-released fix is snowflake.core 1.13.0, available on PyPI and requiring manual upgrade. | HIGH | 8.1 | 40.0% | 80 |
|
| CVE-2022-42965 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | HIGH | 7.5 | 0.8% | 58 |
PoC
|
| CVE-2026-15183 | SQL injection and input-validation weaknesses in the Snowflake Spark Connector (spark-snowflake) before version 3.2.1 let attackers exfiltrate OAuth client credentials, run arbitrary SQL under the connector's Snowflake role, and redirect COPY data-loading operations to attacker-controlled storage. Reported by Snowflake, the flaws are most dangerous in shared/multi-tenant Spark clusters where injected SQL executes with the cluster admin's JDBC credentials, enabling credential theft and privilege escalation. Rated CVSS 4.0 9.2 (Critical); no public exploit identified at time of analysis. | CRITICAL | 9.2 | 0.2% | 46 |
|
| CVE-2026-15925 | Improper TLS hostname verification in the Snowflake Connector for Python (versions before 4.7.1) lets an on-path attacker defeat HTTPS certificate validation, accepting any certificate signed by any trusted CA regardless of the requested hostname. An adversary who can intercept traffic can decrypt and tamper with connector sessions, exposing Snowflake credentials, query results, and staged file data, and can inject arbitrary SQL bounded by the victim role's privileges. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the reporting vendor (Snowflake) rates it CVSS 4.0 9.2. | CRITICAL | 9.2 | 0.2% | 46 |
|
| CVE-2026-13749 | Arbitrary code execution in Snowflake CLI versions prior to 3.19 lets an attacker run code in the context of any developer who bundles or deploys an attacker-supplied Snowpark project. The flaw lives in the Snowpark annotation processor callback template, where untrusted project content is interpolated directly into generated Python code (CWE-94). No public exploit has been identified at time of analysis, but the attack is straightforward and high-impact (CVSS 8.8) given that it executes with the victim's local privileges; exploitation hinges on the victim running the bundling/deployment workflow against malicious content. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-16870 | Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-13744 | SQL injection in Snowflake CLI versions 1.2.2 through 3.18.x allows an attacker to execute unintended SQL statements within a victim's authenticated Snowflake session by planting crafted repository content, project configuration, manifest, or specification input. When a developer processes that attacker-controlled content through a vulnerable command path, the injected SQL runs with the victim's session privileges, enabling data theft, modification, or destruction up to that user's authorization level. There is no public exploit identified at time of analysis, exploitation is not confirmed in CISA KEV, and EPSS is low at 0.31% (23rd percentile), reflecting the user-interaction requirement. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2023-30535 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 1.7% | 44 |
|
| CVE-2023-34231 | gosnowflake is th Snowflake Golang driver. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution. | HIGH | 8.8 | 2.0% | 44 |
|
| CVE-2023-34230 | snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | HIGH | 8.8 | 1.4% | 44 |
|
| CVE-2023-34232 | snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions prior to 1.6.21. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. | HIGH | 8.8 | 1.9% | 44 |
|
| CVE-2023-34233 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Command Injection vulnerability could allow attackers to inject arbitrary commands into system command execution. | HIGH | 8.8 | 1.8% | 44 |
|
| CVE-2026-15736 | SQL injection and local file disclosure in Snowflake SQLAlchemy before 1.11.0 lets an authenticated application user abuse three distinct weaknesses: unsanitized column identifiers in MERGE/upsert operations, improper literal rendering of bound parameters in Snowflake-specific table-creation queries, and unsafe forwarding of connection parameters that can be coerced into reading arbitrary local files. Any application built on this dialect that passes user-controlled keys, strings, or connection settings into the affected APIs can leak or modify data within the connection role's scope and, in some deployments, exfiltrate local files to an attacker endpoint. No public exploit identified at time of analysis; the issues are reported by the vendor (Snowflake) and fixed in 1.11.0. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-6442 | Sandbox escape leading to arbitrary local code execution affects Snowflake Cortex Code CLI (an AI coding agent) in all versions prior to 1.0.25. Because the CLI improperly validates bash commands, an attacker who plants specially crafted content in untrusted material-such as a malicious repository-can cause the agent to run subsequent commands outside its sandbox and execute arbitrary code on the user's device without consent. No public exploit identified at time of analysis; EPSS is low (0.07%) and exploitation is non-deterministic and model-dependent, so real-world reliability is limited. | HIGH | 8.3 | 0.1% | 42 |
|
| CVE-2026-86600 | Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages. | HIGH | 8.2 | 0.3% | 41 |
|