Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22…

High CVSS 8.1

CVECVE-2026-19594

First seen2026-08-12 12:30 UTC

Disclosed2026-08-12 06:21 UTC

Last updated2026-08-12 12:30 UTC

Channel statusauto

Summary

Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal (CWE-22) via unencoded `..` identifier path segments, and HTTP parameter pollution (CWE-141) via unencoded `&`/`#`/`=` characters in query string values. An attacker with access to a downstream application built on snowflake.core could exploit the path traversal by supplying `..` as an object name, causing…

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://pypi.org/project/snowflake.core/1.13.0/

Timeline

2026-08-12 nvd_ingest NVD