Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-28381

Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana Snowflake Datasource

Default version status: unaffected

  • 1.14.7 to ≤ 1.14.12affected

References