CVE-2026-28381

Analyzed Analyzed - Analysis Complete

Snowflake Datasource File Read/Write Vulnerability in Grafana

Publication date: 2026-06-22

Last updated on: 2026-06-30

Assigner: Grafana Labs

Description

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-22

Last Modified

2026-06-30

Generated

2026-07-12

AI Q&A

2026-06-22

EPSS Evaluated

2026-07-11

NVD

CVE-2026-28381

EUVD

EUVD-2026-38244

Affected Vendors & Products

Vendor	Product	Version / Range
grafana	snowflake	From 1.14.7 (inc) to 1.14.12 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves the Snowflake datasource in Grafana, which allows GET and PUT commands. This means that any user who has access to run queries against the data source can read and write files between the local Grafana server and the connected Snowflake host.

Impact Analysis

The vulnerability can have a significant impact because it allows users with query access to read and write files on the local Grafana server and the Snowflake host. This can lead to unauthorized data exposure and modification, potentially compromising the confidentiality and integrity of sensitive information.

Compliance Impact

The vulnerability allows any user with access to the Snowflake datasource in Grafana to execute GET/PUT commands, enabling them to read and write files between the local Grafana server and the connected Snowflake host.

This unauthorized ability to read and write data could lead to exposure or modification of sensitive information, which may violate data protection requirements under regulations such as GDPR and HIPAA.

Therefore, this vulnerability poses a significant risk to compliance with common standards and regulations that mandate strict controls over data confidentiality and integrity.

Hi! I’m here to help you understand CVE-2026-28381. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70