AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Packages

Snowflake security advisories

35 advisories · 10 critical or high in 12 months · latest Sep 17

Advisories page

35 advisories

High 8.2Sep 17Snowflake CLI: improper input validationCVE-2026-92903fixed in 3.27.0 +1Medium 6.5Sep 10Sensitive information written to logs by Snowflake driversCVE-2026-86597fixed in 3.3.0 +5High 8.2Sep 10Workload identity attestation generated before login host validation in Snowflake driversCVE-2026-86600fixed in 3.3.0 +6High 7.4Sep 10Improper OCSP response validation in Snowflake driversCVE-2026-85525fixed in 3.3.0 +3Medium 5.3Sep 10Snowflake JDBC Driver auto-configuration account validation permits credential redirectionCVE-2026-85528fixed in 4.3.4 +2High 8.1Aug 12Snowflake Python APIs: privilege escalationCVE-2026-19594fixed in 1.13.0High 8.8Jul 24Snowflake ODBC Driver: remote code executionCVE-2026-16870fixed in Snowflake libsnowflakeclient 2.9.2 +2Critical 9.2Jul 16Snowflake Connector for Python: improper TLS hostname checkCVE-2026-15925fixed in 3.18.1 +1High 8.3Jul 14Snowflake SQLAlchemy: SQL injectionCVE-2026-15736fixed in 1.11.0Critical 9.2Jul 14Snowflake Spark Connector: SQL injectionCVE-2026-15183fixed in 3.2.1Critical 9.6Jul 8Snowflake Snowpark Python SDK: SQL injectionCVE-2026-15062fixed in 1.53.0High 8.8Jul 8Terraform Provider for Snowflake: SQL injectionCVE-2026-15067fixed in 2.18.0Low 3.3Apr 28, 2025Race condition when checking access to Easy Logging configuration fileCVE-2025-46328fixed in 2.0.4Low 3.3Apr 28, 2025Race condition when checking access to Easy Logging configuration fileCVE-2025-46327fixed in 1.13.3Low 3.3Apr 28, 2025Client-side encryption key in DEBUG logsCVE-2025-46329fixed in 2.2.0Low 3.3Apr 28, 2025Retrying of malformed requestsCVE-2025-46330fixed in 2.2.0Low 3.3Apr 28, 2025Race condition when checking access to Easy Logging configuration fileCVE-2025-46326fixed in 4.4.1Low 3.3Mar 13, 2025Client-side encryption key in DEBUG logsCVE-2025-27496fixed in 3.23.1Medium 4.4Jan 29, 2025Insecure cache files permissionsCVE-2025-24795fixed in 3.13.1Medium 6.7Jan 29, 2025Insecure deserialization of the OCSP response cacheCVE-2025-24794fixed in 3.13.1High 7.0Jan 29, 2025SQL Injection in write_pandasCVE-2025-24793fixed in 3.13.1Medium 5.0Jan 29, 2025Weak temporary files permissionsCVE-2025-24788fixed in 4.3.0High 7.8Jan 29, 2025Untrusted search path on WindowsCVE-2025-24789fixed in 3.22.0Medium 4.4Jan 29, 2025Insecure temporary credential cache file permissionsCVE-2025-24790fixed in 3.22.0Medium 4.4Jan 29, 2025Incorrect validation of temporary credential cache file permissionsCVE-2025-24791fixed in 2.0.2Medium 4.4Jan 29, 2025Signed-to-Unsigned Conversion ErrorCVE-2025-24792fixed in 3.1.0Medium 5.9Oct 30, 20242024-8-14 Snowflake JDBC Security AdvisoryCVE-2024-43382fixed in 3.20.0orlaterMedium 5.5Oct 24, 2024Sensitive data in logsCVE-2024-49750fixed in 3.12.3Medium 4.0Mar 15, 2024Snowflake Hive MetaStore Connector Security AdvisoryCVE-2024-28851fixed in N/AMedium 6.0Dec 22, 2023Snowflake Connector .NET Security AdvisoryCVE-2023-51662fixed in 2.1.5High 7.3Jun 8, 2023Snowflake NodeJS Driver Security AdvisoryCVE-2023-34232fixed in 1.6.21High 7.3Jun 8, 2023Snowflake Golang Driver Security AdvisoryCVE-2023-34231fixed in 1.6.19High 7.3Jun 8, 2023Snowflake Python Connector Security AdvisoryCVE-2023-34233fixed in 3.0.2High 7.3Jun 8, 2023Snowflake Connector .Net Security AdvisoryCVE-2023-34230fixed in 2.0.18High 7.3Apr 13, 20232023-3-17 Snowflake JDBC Security AdvisoryCVE-2023-30535fixed in 3.13.29
About Snowflake

Security advisories Snowflake publishes for its own products.

www.snowflake.com/en/why-snowflake/snowflake-security-hub/security-bulletinsSnowflake

Snowflake elsewhere on Ibis: Acquisitions · Quarterly · Paydays · Releases · Repos · TechConf