Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

snowflake-connector-python

12 known vulnerabilities (1 critical, 5 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
5.2.0 (Nov 4, 2026): no advisory affects it
Newest unaffected release
5.2.0 (Nov 4, 2026), the latest release
Advisories
12 · 1 critical, 5 high, 5 medium, 1 low
Weekly downloads
25.6M
Dependents
337
Releases
193 since 1.4.5 (Aug 31, 2017)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)

    Affected: from 2.3.4, fixed in 4.8.1; from 5.0.0b1, fixed in 5.2.0.

    Fixed in 4.8.1 (released Oct 26, 2026, 11 days before disclosure) and 5.2.0 (released Nov 4, 2026, 2 days before disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2026-114456Medium 6.5

    Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

    Affected: fixed in 4.8.0.

    Fixed in 4.8.0 (released Sep 30, 2026, 35 days before disclosure).

    The latest release, 5.2.0, is not affected.

  • Workload identity attestation generated before login host validation in Snowflake drivers

    Affected: from 3.14.1, fixed in 4.7.3.

    Fixed in 4.7.3 (released Sep 3, 2026, 5 days before disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2026-86597Medium 6.5

    Sensitive information written to logs by Snowflake drivers

    Affected: fixed in 4.7.3; fixed in 4.7.3.

    Fixed in 4.7.3 (released Sep 3, 2026, 5 days before disclosure).

    The latest release, 5.2.0, is not affected.

  • Improper OCSP response validation in Snowflake drivers

    Affected: fixed in 4.7.3.

    Fixed in 4.7.3 (released Sep 3, 2026, 1 day before disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2026-15925Critical 9.2

    Improper TLS Hostname Verification in Snowflake Connector for Python

    Affected: fixed in 3.18.1; from 4.0.0, fixed in 4.7.1; fixed in 3.18.1; from 4.0.0, fixed in 4.7.1.

    Fixed in 3.18.1 (released Jul 15, 2026, 1 day before disclosure) and 4.7.1 (released Jul 15, 2026, 1 day before disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2025-24795Medium 4.4

    The Snowflake Connector for Python uses insecure cache files permissions

    Affected: from 2.3.7, fixed in 3.13.1.

    Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2025-24794Medium 6.7

    The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache

    Affected: from 2.7.12, fixed in 3.13.1.

    Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure).

    The latest release, 5.2.0, is not affected.

  • Snowflake Connector for Python has an SQL Injection in write_pandas

    Affected: from 2.2.5, fixed in 3.13.1.

    Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure).

    The latest release, 5.2.0, is not affected.

  • CVE-2024-49750Medium 5.5

    Snowflake Connector for Python has sensitive data in logs

    Affected: fixed in 3.12.3.

    Fixed in 3.12.3 (released Oct 24, 2024, the day of disclosure).

    The latest release, 5.2.0, is not affected.

  • Snowflake Python Connector vulnerable to Command Injection

    Affected: fixed in 3.0.2.

    Fixed in 3.0.2 (released Mar 23, 2023, 77 days before disclosure).

    The latest release, 5.2.0, is not affected.

  • Exponential ReDoS in snowflake-connector-python leads to denial of service

    Affected: fixed in 2.8.2.

    Fixed in 2.8.2 (released Nov 19, 2022, 10 days after disclosure).

    The latest release, 5.2.0, is not affected.