CVE-2026-114456
Received Received - Intake

Authentication Bypass in Snowflake Client Drivers

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: SNOWFLAKE

Description
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-114456
EUVD
EUVD-2026-116883

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Snowflake client drivers using the externalbrowser SSO flow. It involves weaknesses in the local loopback callback listener that receives identity provider responses. The listener reflected arbitrary Origin headers in CORS responses and accepted the first token-bearing request without verifying a CSRF state value. An attacker on the same machine could exploit this to forge a callback response, causing login failures.

Impact Analysis

If exploited, this vulnerability could prevent users from successfully authenticating via SSO. Attackers could cause login attempts to fail by interfering with the callback process. The impact is limited to login disruption and does not directly expose data or credentials.

Mitigation Strategies
  • Upgrade affected Snowflake client drivers to the latest patched versions: Python 4.8.0, Go Driver v2.3.0, JDBC Driver 4.4.0, Node.js Driver 3.4.0, .NET 6.3.0, ODBC Driver 4.0.0, PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1.
  • For Go v1 users, migrate to the latest major version of the module as older versions are unsupported.
  • Manually verify and apply all available security patches for the affected drivers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114456. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...