Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.0.0, 4.3.0, 2.11.1
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 4.0.0, 4.3.0, 2.11.1.
- Exploitation0/40No signal
- Exposure7/25Reachable over the network without a login · Data gap: No advisory context yet
- Reach20/20snowflake-connector-python: 25.6M downloads a week
- Severity6.5/10CVSS 6.5
- No patch0/5No signal
What would change the score
- Would score about 89 if added to CISA KEV
- Would score about 84 if CISA's SSVC rates exploitation active
- Would score about 49 if advisories confirm default setups are exposed
CVE-2026-114456 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 6.5 (medium) and affects Snowflake Connector for Python, Snowflake Go Driver, Snowflake JDBC Driver and 7 more; fixed in 4.0.0, 4.3.0 and 2.11.1.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 34/100 · provisional
- Fix
- Fixed in 4.0.0, 4.3.0, 2.11.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Multiple Snowflake client drivers that use the externalbrowser single sign-on login flow are affected by a flaw in the local listener that receives the identity provider's login response. A remote attacker, without logging in and while a user's login is in progress, can send a forged callback that makes the login attempt fail.
Read the original description
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.
Impact
- Widely used
snowflake-connector-python has 25.6m weekly downloads.Source: pypistats.org
337 packages depend on snowflake-connector-python.Source: deps.dev
What to do
Upgrade to a fixed version: 4.0.0, 4.3.0, 2.11.1.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- snowflake-connector-pythonPyPI
fixed in 4.8.0
- github.com/snowflakedb/gosnowflakeGo
From 1.1.5 · through 1.19.1
- github.com/snowflakedb/gosnowflake/v2Go
From 2.0.0 · fixed in 2.3.0
- net.snowflake:snowflake-jdbcMaven
From 3.2.3 · fixed in 4.4.0
- net.snowflake:snowflake-jdbc-fipsMaven
From 3.2.3 · fixed in 4.4.0
- net.snowflake:snowflake-jdbc-thinMaven
From 3.2.3 · fixed in 4.4.0
- snowflake-sdknpm
From 1.6.0 · fixed in 3.4.0
- Snowflake.DataNuGet
From 1.0.12 · fixed in 6.3.0
Show all 11 packagesShow fewer packages
- Snowflake Snowflake ODBC Driver
From 3.7.0 · fixed in 4.0.0
- Snowflake Snowflake PHP PDO Driver
From 3.2.0 · fixed in 4.3.0
- Snowflake Snowflake Libsnowflakeclient
From 2.1.0 · fixed in 2.11.1
Evidence 8
- Repository
- Repository
- Link
- Link
- Link
Show all 8 sourcesShow fewer sources
- Link
- Link
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-114456
Is CVE-2026-114456 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-114456?
snowflake-connector-python (PyPI): before 4.8.0. github.com/snowflakedb/gosnowflake (Go): from 1.1.5 through 1.19.1. github.com/snowflakedb/gosnowflake/v2 (Go): from 2.0.0 before 2.3.0. net.snowflake:snowflake-jdbc (Maven): from 3.2.3 before 4.4.0. net.snowflake:snowflake-jdbc-fips (Maven): from 3.2.3 before 4.4.0. 6 more packages are listed on the page.Source: cve.now feed data
How do I fix CVE-2026-114456?
Upgrade to a fixed version: 4.0.0, 4.3.0, 2.11.1.Source: cve.now feed data