CVE-2026-19594

Executive Summary

CVE-2026-19594 is a confused-deputy privilege escalation vulnerability in the Snowflake Python API (snowflake.core) affecting versions prior to 1.13.0. The flaw stems from two related input-sanitization weaknesses — path traversal via unencoded .. identifier segments and HTTP parameter pollution via unencoded &/#/= characters — that allow a low-privileged attacker to force a higher-privileged application session to issue REST requests against unintended resources. Successful exploitation results in high-impact unauthorized operations (integrity and availability impact rated HIGH) but no confidentiality impact, with a CVSS score of 8.1. The fix is available in version 1.13.0, but the vendor has not yet published an official advisory, and patch confidence remains at 0/4 across tracked sources.

Technical Analysis

The vulnerability resides in the snowflake.core package, the low-level Python API layer used by the Snowflake Python connector and downstream applications to interact with Snowflake's REST endpoints. The NVD description identifies two distinct but related weaknesses:

Weakness 1 — Path Traversal (CWE-22): The library fails to URL-encode .. sequences when an object name or identifier is used to construct a REST API path. When an application passes an untrusted identifier to snowflake.core, the library concatenates that identifier into the request path without sanitization. An attacker who submits .. (or a path containing .. segments) as the object name can cause the request to resolve against a parent resource in the API hierarchy, bypassing the intended resource boundary.

Weakness 2 — HTTP Parameter Pollution (CWE-141): The library also fails to URL-encode reserved characters (&, #, =) when user-controlled values are placed into query-string parameters. Because these characters are not percent-encoded, an attacker can inject additional query parameters or truncate the query string by inserting # (fragment separator) or & (parameter delimiter). This enables overriding constraints on sensitive operations such as swap, clone, or rename of Snowflake objects.

The confused-deputy aspect is central: the vulnerable code runs within the context of a privileged Snowflake session (e.g., an EXECUTE AS OWNER stored procedure, a Streamlit app, or a Native App). The attacker does not need credentials to that session — they only need to control an identifier or object-name string that flows into snowflake.core through the application's logic. The library, acting on behalf of the privileged session, then executes the attacker-influenced REST requests with elevated rights.

Affected components: The entire snowflake.core module as used by the Snowflake Python connector and any application built on it. Version 1.13.0 contains the fix and also addresses several additional security findings, though the NVD description does not enumerate those.

Attack surface: Any Snowflake Python application that passes user-controlled strings into object-name or identifier parameters. Common entry points include web dashboards, internal tooling, ETL pipelines, and AI/ML workloads built on Snowflake's Python ecosystem.

Exploitation Scenarios

Based strictly on the NVD description, the attack chain proceeds as follows:

Step 1 — Reconnaissance / target identification: The attacker identifies an application built on snowflake.core that accepts user-controlled identifier/object-name strings and forwards them to Snowflake under a higher-privileged session context. This could be a Streamlit app exposed internally, a Native App, or an application using stored procedures with EXECUTE AS OWNER. The attacker determines the input parameter that ultimately reaches the vulnerable API call.

Step 2 — Triggering the flaw class: The attacker supplies a crafted identifier string. For the path-traversal variant, the attacker provides .. (or a path like .. /.. /target_object) as the object name. For the parameter-pollution variant, the attacker inserts &, #, or = into the free-form name field.

Step 3 — Payload / execution method (vulnerability-class level):

• Path traversal: The attacker's .. identifier causes snowflake.core to issue a REST request against a parent resource in the Snowflake API hierarchy — i.e., a resource the attacker should not be able to access with their own privileges. Because the request is issued under the application's privileged session, Snowflake's authorization layer sees the request as legitimate and permits it.
• Parameter pollution: The attacker injects &/#/= into the query string to override constraints on swap, clone, or rename operations. For example, injecting additional parameters may alter the target resource of a RENAME or CLONE operation, or a # fragment may truncate the query such that validation logic is bypassed.

Step 4 — Post-exploitation impact: The attacker can force the privileged session to execute destructive or disruptive operations: renaming or swapping objects to which they lack privileges, cloning sensitive objects into attacker-controlled namespaces, or corrupting object references across the account. Because the CVSS vector indicates high impact on integrity (I:H) and availability (A:H) but no confidentiality impact (C:N), the primary consequences are data integrity compromise and denial-of-service through resource corruption or deletion.

Note: No public PoC or exploit code is currently available. The attack chain above is inferred strictly from the vulnerability class and the NVD description. The exact REST endpoints and parameter names are not disclosed in available data.

Impact Assessment

Business impact: Applications built on snowflake.core may be manipulated by low-privileged users to perform unauthorized operations on Snowflake objects under elevated privileges. The ability to override clone/swap/rename constraints can result in:

• Unauthorized renaming or swapping of tables, views, schemas, or warehouses (integrity impact).
• Disruption of downstream ETL processes, dashboards, or analytics workloads referencing renamed/cloned objects (availability impact).
• Potential data exposure is limited (confidentiality impact: NONE) because the flaw enables state-changing operations rather than data exfiltration.

Affected systems: Any deployment using Snowflake Python API (snowflake.core) prior to version 1.13.0 — including the Snowflake Python connector, Streamlit applications, Native Apps, and stored procedures that invoke these libraries under EXECUTE AS OWNER or equivalent elevated sessions.

CVSS reflection (8.1, High): AV:N (network-accessible), AC:L (no special conditions), PR:L (requires low-privileged access), UI:N (no user interaction), S:U (scope unchanged), C:N (no confidentiality impact), I:H (high integrity impact), A:H (high availability impact). The high severity reflects the ease of exploitation (only low privileges required, no user interaction) combined with high integrity/availability consequences.

Blast radius: Moderate — exploitation requires the attacker to already have an account or application access within the Snowflake environment. It does not enable remote unauthenticated compromise. However, the confused-deputy pattern means many downstream applications could be affected simultaneously if they share a common vulnerable library version.

Detection Guidance

Sigma Rule

title: Snowflake.core REST API Path Traversal or Parameter Pollution Attempt
id: 6e61c2a4-5a4e-4b5a-9e0a-1a1c3d4e5f6a
status: experimental
description: Detects suspicious REST API requests from snowflake.core processes containing path traversal sequences or reserved characters in identifier fields.
logsource:
    product: snowflake
    service: query_history
detection:
    selection_requests:
        QueryText|contains:
            - 'snowflake.core'
            - 'REST API'
        QueryText|contains:
            - '..'
            - '&'
            - '#'
            - '='
    selection_operations:
        QueryType|contains:
            - 'RENAME'
            - 'SWAP'
            - 'CLONE'
    selection_sensitive:
        QueryText|contains:
            - 'EXECUTE AS OWNER'
            - 'STREAMLIT'
            - 'NATIVE APP'
    condition: all of selection_*
level: high
fields:
    - USER_NAME
    - QUERY_TEXT
    - CLIENT_APPLICATION_ID
    - ROLE_NAME
falsepositives:
    - Legitimate use of '%' or '#' in SQL identifiers (rare)
    - Normal rename/clone operations by administrators

YARA Rule

rule Snowflake_Core_Unsanitized_Identifiers
{
    meta:
        author = "ValterIT Threat Intelligence"
        description = "Detects Python payloads or scripts exploiting CVE-2026-19594 (snowflake.core path traversal & parameter pollution)"
        cve = "CVE-2026-19594"
        date = "2026-04-03"
        severity = "high"
    strings:
        $snowflake_core = "snowflake.core" ascii nocase
        $api_call = "REST" ascii nocase
        $path_trav = ".." 
        $param_pollute = "&" ascii
        $fragment = "#" ascii
        $equals = "=" ascii
        $rename_op = "RENAME" ascii nocase
        $clone_op = "CLONE" ascii nocase
        $swap_op = "SWAP" ascii nocase
    condition:
        $snowflake_core and
        ($api_call or $rename_op or $clone_op or $swap_op) and
        ($path_trav or $param_pollute)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-19594 - Snowflake.core Path Traversal in REST API Identifier";
    flow:to_server,established;
    http.uri;
    content:"snowflake"; nocase;
    content:"/v1/"; distance:0;
    pcre:"/(?:%2e%2e|\\.\\.)/i";
    reference:cve,CVE-2026-19594;
    classtype:attempted-user;
    sid:2026195941; rev:1;)

alert http any any -> any any (msg:"CVE-2026-19594 - Snowflake.core Parameter Pollution via Reserved Characters";
    flow:to_server,established;
    http.uri;
    content:"snowflake"; nocase;
    pcre:"/(?:&|#|=)/i";
    reference:cve,CVE-2026-19594;
    classtype:attempted-user;
    sid:2026195942; rev:1;)

Elastic Detection

sequence by host.name, user.name
  with maxspan=5m
  [ process where event.type == "start" and
      process.name : ("python*", "streamlit*") and
      process.args : ("*snowflake.core*", "*REST*") ]
  [ network where event.action == "connection" and
      destination.port == 443 and
      process.name : ("python*", "streamlit*") and
      url.path : "*snowflake*" and
      (url.path : "*%2e%2e*" or url.path : "*..*" or
       url.query : "*&*" or url.query : "*#*" or url.query : "*=*")]

Splunk SPL Query

index=snowflake sourcetype=query_history
| search QUERY_TEXT="*snowflake.core*" 
    AND (QUERY_TEXT="*..*" OR QUERY_TEXT="*&*" OR QUERY_TEXT="*#*" OR QUERY_TEXT="*=*")
    AND (QUERY_TYPE="RENAME*" OR QUERY_TYPE="CLONE*" OR QUERY_TYPE="SWAP*")
| eval suspicious=case(
      QUERY_TEXT LIKE "%EXECUTE AS OWNER%" OR QUERY_TEXT LIKE "%STREAMLIT%" OR QUERY_TEXT LIKE "%NATIVE APP%", "HIGH_RISK_CONTEXT",
      true(), "CONTEXT_UNKNOWN")
| table _time, USER_NAME, ROLE_NAME, QUERY_TYPE, QUERY_TEXT, CLIENT_APPLICATION_ID, suspicious
| sort - _time
| where suspicious="HIGH_RISK_CONTEXT"

Wazuh OSSEC Rule

<group name="snowflake,">
    <rule id="195940" level="12">
        <decoded_as>snowflake-query-history</decoded_as>
        <field name="query_text">\.\.</field>
        <field name="query_text">snowflake\.core</field>
        <description>CVE-2026-19594: Snowflake.core path traversal pattern in identifier field</description>
        <group>snowflake_exploit_attempt,</group>
        <mitre id="T1190"/>
    </rule>
    <rule id="195941" level="12">
        <decoded_as>snowflake-query-history</decoded_as>
        <field name="query_text">[&#=]</field>
        <field name="query_text">snowflake\.core</field>
        <description>CVE-2026-19594: Snowflake.core parameter pollution pattern in query string</description>
        <group>snowflake_exploit_attempt,</group>
        <mitre id="T1190"/>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED (no patch evidence from any tracked source). The NVD description confirms a fix exists in version 1.13.0, but no official vendor advisory, commit, or changelog reference has been indexed by tracked sources at the time of writing. This discrepancy suggests the vendor may not yet have published a formal advisory, or CVE data is prior to public disclosure.

Immediate mitigations (until upgrade is performed):

1. Review and restrict elevated-session usage: Audit stored procedures using EXECUTE AS OWNER, Streamlit apps, and Native Apps that pass user-controlled identifier strings into snowflake.core calls. Where possible, replace dynamic identifier construction with allowlist validation.
2. Input validation: Implement strict validation at the application layer — reject any identifier containing .., &, #, or =. Apply URL encoding at the application boundary, not only in the library.
3. Least privilege: Review Snowflake roles granted to application sessions. Ensure applications that consume user input run with the minimum privileges required, avoiding EXECUTE AS OWNER when a lower-privilege context suffices.
4. Monitor: Deploy the detection rules above to identify exploitation attempts. Focus on logs of RENAME, SWAP, and CLONE operations originating from applications using snowflake.core.

Patch/Upgrade steps:

1. Upgrade the snowflake-connector-python package (which bundles snowflake.core) to version 1.13.0 or later in all environments: pip install --upgrade snowflake-connector-python.
2. Rebuild and redeploy all Streamlit apps, Native Apps, and Docker images that depend on the vulnerable library to ensure the patched version is baked in.
3. Verify the upgrade: run pip show snowflake-connector-python and confirm version ≥ 1.13.0. Test clone/swap/rename operations in a staging environment first.
4. Track the Snowflake Python API release notes and vendor security advisories for supplementary guidance on the "several additional security findings" addressed in 1.13.0.

Long-term hardening:

1. Establish a dependency-pinning policy with regular vulnerability scanning (e.g., pip-audit in CI/CD pipelines) for Snowflake-related packages.
2. Implement a security review checklist for any application that forwards user-controlled identifier strings into database APIs — this class of confused-deputy vulnerability is systemic and not unique to Snowflake.
3. Adopt defensive coding practices: always URL-encode user-supplied strings before constructing REST paths or query strings; never trust client-supplied object names without schema-level validation.
4. Consider compensating controls: network-level egress filtering for Snowflake REST API endpoints, and Snowflake account-level IP allowlisting to reduce the attack surface.

References

1. NVD — CVE-2026-19594: https://nvd.nist.gov/vuln/detail/CVE-2026-19594 (CVSS 8.1, CWE-22)
2. Snowflake Python Connector release notes (check for 1.13.0): https://docs.snowflake.com/en/developer-guide/python-connector/python-connector-api
3. Snowflake security advisories (pending confirmation of vendor advisory): https://www.snowflake.com/support/security-advisories/
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploit-in-the-wild evidence: No exploit-in-the-wild activity or known threat-actor campaigns associated with this CVE have been observed at the time of writing. No CISA KEV listing exists (CISA KEV: NO). The EPSS score has not yet been assigned by FIRST.org.