Snowflake security advisories

35 advisories · 10 critical or high in 12 months · latest Sep 17

35 advisories

Date	Advisory	Severity	Fixed in
Sep 17	Snowflake CLI: improper input validation High8.2Sep 17 CVE-2026-929033.27.0+1 more	High8.2	3.27.0+1 more
Sep 10	Sensitive information written to logs by Snowflake drivers Medium6.5Sep 10 CVE-2026-865973.3.0+5 more	Medium6.5	3.3.0+5 more
Sep 10	Workload identity attestation generated before login host validation in Snowflake drivers High8.2Sep 10 CVE-2026-866003.3.0+6 more	High8.2	3.3.0+6 more
Sep 10	Improper OCSP response validation in Snowflake drivers High7.4Sep 10 CVE-2026-855253.3.0+3 more	High7.4	3.3.0+3 more
Sep 10	Snowflake JDBC Driver auto-configuration account validation permits credential redirection Medium5.3Sep 10 CVE-2026-855284.3.4+2 more	Medium5.3	4.3.4+2 more
Aug 12	Snowflake Python APIs: privilege escalation High8.1Aug 12 CVE-2026-195941.13.0	High8.1	1.13.0
Jul 24	Snowflake ODBC Driver: remote code execution High8.8Jul 24 CVE-2026-16870Snowflake libsnowflakeclient 2.9.2+2 more	High8.8	Snowflake libsnowflakeclient 2.9.2+2 more
Jul 16	Snowflake Connector for Python: improper TLS hostname check Critical9.2Jul 16 CVE-2026-159253.18.1+1 more	Critical9.2	3.18.1+1 more
Jul 14	Snowflake SQLAlchemy: SQL injection High8.3Jul 14 CVE-2026-157361.11.0	High8.3	1.11.0
Jul 14	Snowflake Spark Connector: SQL injection Critical9.2Jul 14 CVE-2026-151833.2.1	Critical9.2	3.2.1
Jul 8	Snowflake Snowpark Python SDK: SQL injection Critical9.6Jul 8 CVE-2026-150621.53.0	Critical9.6	1.53.0
Jul 8	Terraform Provider for Snowflake: SQL injection High8.8Jul 8 CVE-2026-150672.18.0	High8.8	2.18.0
Apr 282025	Race condition when checking access to Easy Logging configuration file Low3.3Apr 28, 2025 CVE-2025-463282.0.4	Low3.3	2.0.4
Apr 282025	Race condition when checking access to Easy Logging configuration file Low3.3Apr 28, 2025 CVE-2025-463271.13.3	Low3.3	1.13.3
Apr 282025	Client-side encryption key in DEBUG logs Low3.3Apr 28, 2025 CVE-2025-463292.2.0	Low3.3	2.2.0
Apr 282025	Retrying of malformed requests Low3.3Apr 28, 2025 CVE-2025-463302.2.0	Low3.3	2.2.0
Apr 282025	Race condition when checking access to Easy Logging configuration file Low3.3Apr 28, 2025 CVE-2025-463264.4.1	Low3.3	4.4.1
Mar 132025	Client-side encryption key in DEBUG logs Low3.3Mar 13, 2025 CVE-2025-274963.23.1	Low3.3	3.23.1
Jan 292025	Insecure cache files permissions Medium4.4Jan 29, 2025 CVE-2025-247953.13.1	Medium4.4	3.13.1
Jan 292025	Insecure deserialization of the OCSP response cache Medium6.7Jan 29, 2025 CVE-2025-247943.13.1	Medium6.7	3.13.1
Jan 292025	SQL Injection in write_pandas High7.0Jan 29, 2025 CVE-2025-247933.13.1	High7.0	3.13.1
Jan 292025	Weak temporary files permissions Medium5.0Jan 29, 2025 CVE-2025-247884.3.0	Medium5.0	4.3.0
Jan 292025	Untrusted search path on Windows High7.8Jan 29, 2025 CVE-2025-247893.22.0	High7.8	3.22.0
Jan 292025	Insecure temporary credential cache file permissions Medium4.4Jan 29, 2025 CVE-2025-247903.22.0	Medium4.4	3.22.0
Jan 292025	Incorrect validation of temporary credential cache file permissions Medium4.4Jan 29, 2025 CVE-2025-247912.0.2	Medium4.4	2.0.2
Jan 292025	Signed-to-Unsigned Conversion Error Medium4.4Jan 29, 2025 CVE-2025-247923.1.0	Medium4.4	3.1.0
Oct 302024	2024-8-14 Snowflake JDBC Security Advisory Medium5.9Oct 30, 2024 CVE-2024-433823.20.0orlater	Medium5.9	3.20.0orlater
Oct 242024	Sensitive data in logs Medium5.5Oct 24, 2024 CVE-2024-497503.12.3	Medium5.5	3.12.3
Mar 152024	Snowflake Hive MetaStore Connector Security Advisory Medium4.0Mar 15, 2024 CVE-2024-28851N/A	Medium4.0	N/A
Dec 222023	Snowflake Connector .NET Security Advisory Medium6.0Dec 22, 2023 CVE-2023-516622.1.5	Medium6.0	2.1.5
Jun 82023	Snowflake NodeJS Driver Security Advisory High7.3Jun 8, 2023 CVE-2023-342321.6.21	High7.3	1.6.21
Jun 82023	Snowflake Golang Driver Security Advisory High7.3Jun 8, 2023 CVE-2023-342311.6.19	High7.3	1.6.19
Jun 82023	Snowflake Python Connector Security Advisory High7.3Jun 8, 2023 CVE-2023-342333.0.2	High7.3	3.0.2
Jun 82023	Snowflake Connector .Net Security Advisory High7.3Jun 8, 2023 CVE-2023-342302.0.18	High7.3	2.0.18
Apr 132023	2023-3-17 Snowflake JDBC Security Advisory High7.3Apr 13, 2023 CVE-2023-305353.13.29	High7.3	3.13.29

About Snowflake

Security advisories Snowflake publishes for its own products.

www.snowflake.com/en/why-snowflake/snowflake-security-hub/security-bulletins Snowflake

Snowflake elsewhere on fru.dev: Acquisitions · Quarterly · Paydays · Releases · TechConf

Critical advisories by email