Insufficient Input Sanitization in Snowflake Python API by Snowflake

CVE-2026-19594

What is CVE-2026-19594?

The Snowflake Python API suffers from insufficient input sanitization, leading to potential privilege escalation through two vulnerabilities: path traversal via improperly encoded .. identifiers and HTTP parameter pollution via unencoded characters in query strings. An attacker with access to a downstream application that utilizes snowflake.core can exploit these weaknesses. They may leverage path traversal to manipulate resource requests or use parameter pollution to circumvent constraints on object operations, allowing unauthorized access under privileged sessions. Users are advised to upgrade to version 1.13.0 to mitigate these risks and enhance security.

References