CVE-2026-19594
Received Received - Intake

Path Traversal in Snowflake Python API

Publication date: 2026-08-12

Last updated on: 2026-08-12

Assigner: SNOWFLAKE

Description
Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path segments, and HTTP parameter pollution (CWE-141) via unencoded `&`/`#`/`=` characters in query string values. An attacker with access to a downstream application built on snowflake.core could exploit the path traversal by supplying `..` as an object name, causing `snowflake.core` to issue REST requests against a parent resource or exploit the parameter pollution by injecting `&`/`#`/`=` into a free-form name field to override constraints on swap, clone, or rename operations — all executed under the application's privileged session. Successful exploitation requires the attacker to control an identifier or object-name string in an application built on snowflake.core that passes it to `snowflake.core` under a higher-privileged Snowflake session (e.g., an EXECUTE AS OWNER stored procedure, Streamlit app, or Native App). The fix is available in Snowflake Python API version 1.13.0, which also addresses several additional security findings. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-12
Last Modified
2026-08-12
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-31
NVD
CVE-2026-19594
EUVD
EUVD-2026-57071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snowflake snowflake_python_api 1.13.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-141 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves insufficient input sanitization in the Snowflake Python API (snowflake.core) versions before 1.13.0. It allows two types of attacks: path traversal, where attackers use `..` in object names to access parent resources, and HTTP parameter pollution, where special characters like `&`, `#`, or `=` are injected into query strings to override operations such as swap, clone, or rename. Exploitation requires an attacker to control an identifier passed to snowflake.core under a privileged session.

Detection Guidance

Detect this vulnerability by checking the version of the Snowflake Python API (`snowflake.core`) in use. If it is below 1.13.0, the system is vulnerable. Commands to check the version include: pip show snowflake or pip list | grep snowflake. Review applications using snowflake.core for object names or identifiers passed to it, especially in stored procedures, Streamlit apps, or Native Apps.

Impact Analysis

An attacker could escalate privileges by manipulating object names or query parameters, potentially accessing unauthorized data or performing restricted operations. This could lead to data breaches, unauthorized modifications, or service disruptions if the application relies on snowflake.core for sensitive tasks.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized access to sensitive data or operations, potentially leading to data breaches. GDPR and HIPAA require strict access controls and data protection; exploitation of this flaw may result in non-compliance, legal penalties, or reputational damage.

Mitigation Strategies

Immediately upgrade the Snowflake Python API to version 1.13.0 or later using pip install --upgrade snowflake. Review and audit applications using snowflake.core for any object names or identifiers that could be manipulated via path traversal or parameter pollution. Remove or sanitize user-controlled input in these fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19594. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart