Snowflake
6 CVEs across 20 Snowflake products. Browse Snowflake vulnerabilities, severities, and proof-of-concept exploits.
Snowflake products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19594 | High | 8.1 | 2026-08-12 | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two re… |
CVE-2026-16870 | High | 8.8 | 2026-07-24 | Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stac… |
CVE-2026-15925 | | 2026-07-16 | Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypas… | |
CVE-2026-15736 | High | 8.3 | 2026-07-14 | Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in mer… |
CVE-2026-15183 | | 2026-07-14 | Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth cl… | |
CVE-2026-15067 | High | 8.8 | 2026-07-08 | Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input co… |
CVE-2026-15062 | Critical | 9.6 | 2026-07-08 | SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to… |
CVE-2026-13752 | Medium | 6.0 | 2026-06-29 | Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying cra… |
CVE-2026-13751 | Medium | 4.1 | 2026-06-29 | Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !sourc… |
CVE-2026-13750 | Medium | 5.5 | 2026-06-29 | Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug… |
CVE-2026-13749 | High | 8.8 | 2026-06-29 | Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during… |
CVE-2026-13748 | Medium | 6.3 | 2026-06-29 | Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowfla… |
CVE-2026-13746 | Low | 3.6 | 2026-06-29 | Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by su… |
CVE-2026-13744 | High | 8.3 | 2026-06-29 | Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repositor… |
CVE-2026-10804 | Low | 3.6 | 2026-06-04 | A vulnerability has been found in Streamlit up to 1.53.0. Impacted is an unknown function in the library lib/streamlit/runtime/caching/hashing.py of the compon… |
CVE-2026-6442 | High | 8.3 | 2026-04-16 | Improper validation of bash commands in Snowflake Cortex Code CLI versions prior to 1.0.25 allowed subsequent commands to execute outside the sandbox. An attac… |
CVE-2026-33682 | Medium | 4.7 | 2026-03-26 | Streamlit is a data oriented application development framework for python. Streamlit Open Source versions prior to 1.54.0 running on Windows hosts have an unau… |
CVE-2026-3293 | Low | 3.3 | 2026-02-27 | A weakness has been identified in snowflakedb snowflake-jdbc up to 4.0.1. Impacted is the function SdkProxyRoutePlanner of the file src/main/java/net/snowflake… |
CVE-2025-46330 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTT… |
CVE-2025-46329 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information… |
CVE-2025-46328 | Low | 3.3 | 2025-04-28 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (T… |
CVE-2025-46327 | Low | 3.3 | 2025-04-28 | gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condi… |
CVE-2025-46326 | Low | 3.3 | 2025-04-28 | snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TO… |
CVE-2025-46614 | Low | 3.3 | 2025-04-28 | In Snowflake ODBC Driver before 3.7.0, in certain code paths, the Driver logged the whole SQL query at the INFO level, aka Insertion of Sensitive Information i… |
CVE-2025-27496 | Low | 3.3 | 2025-03-13 | Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versi… |
CVE-2025-24795 | Medium | 4.4 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24794 | Medium | 6.7 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24793 | High | 7.0 | 2025-01-29 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2025-24788 | Medium | 5.0 | 2025-01-29 | snowflake-connector-net is the Snowflake Connector for .NET. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for .NET in which f… |
CVE-2025-24790 | Medium | 4.4 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24789 | High | 7.8 | 2025-01-29 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediat… |
CVE-2025-24791 | Medium | 4.4 | 2025-01-29 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissio… |
CVE-2024-43382 | Medium | 5.9 | 2024-10-30 | Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting that can result in data being uploaded to an encrypted stage without t… |
CVE-2024-49750 | Medium | 5.5 | 2024-10-24 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2024-42474 | Medium | 6.5 | 2024-08-12 | Streamlit is a data oriented application development framework for python. Snowflake Streamlit open source addressed a security vulnerability via the static fi… |
CVE-2024-28851 | Medium | 4.0 | 2024-03-15 | The Snowflake Hive metastore connector provides an easy way to query Hive-managed data via Snowflake. Snowflake Hive MetaStore Connector has addressed a potent… |
CVE-2023-51662 | Medium | 6.0 | 2023-12-22 | The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a… |
CVE-2023-34233 | High | 8.8 | 2023-06-08 | The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations… |
CVE-2023-34232 | High | 7.3 | 2023-06-08 | snowflake-connector-nodejs, a NodeJS driver for Snowflake, is vulnerable to command injection via single sign on (SSO) browser URL authentication in versions p… |
CVE-2023-34230 | High | 7.3 | 2023-06-08 | snowflake-connector-net, the Snowflake Connector for .NET, is vulnerable to command injection prior to version 2.0.18 via SSO URL authentication. In order to e… |
CVE-2023-34231 | High | 8.8 | 2023-06-08 | gosnowflake is th Snowflake Golang driver. Prior to version 1.6.19, a command injection vulnerability exists in the Snowflake Golang driver via single sign-on… |
CVE-2023-30535 | High | 7.3 | 2023-04-14 | Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC drive… |
CVE-2023-27494 | Medium | 5.9 | 2023-03-16 | Streamlit, software for turning data scripts into web applications, had a cross-site scripting (XSS) vulnerability in versions 0.63.0 through 0.80.0. Users of… |
CVE-2022-42965 | Low | 3.7 | 2022-11-09 | An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply… |
CVE-2022-35918 | Medium | 6.5 | 2022-08-01 | Streamlit is a data oriented application development framework for python. Users hosting Streamlit app(s) that use custom components are vulnerable to a direct… |
CVE-2010-0798 | | 2010-03-02 | SQL injection vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vecto… | |
CVE-2010-0797 | | 2010-03-02 | Cross-site scripting (XSS) vulnerability in the T3BLOG extension 0.6.2 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via… |