# snowflake-connector-python (PyPI) vulnerabilities 12 known vulnerabilities (1 critical, 5 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 5.2.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 5.2.0 (Nov 4, 2026), the latest release - Weekly downloads: 25.6M - Dependents: 337 - Releases: 193 since 1.4.5 (Aug 31, 2017) - Registry: https://pypi.org/project/snowflake-connector-python/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-123859: 2.3.4 to 4.8.0 (4.8.1 is outside it); 5.0.0b1 to 5.1.0 (5.2.0 is outside it) - CVE-2026-114456: 1.4.5 to 4.7.5 (4.8.0 is outside it) - CVE-2026-86600: 3.14.1 to 4.7.2 (4.7.3 is outside it) - CVE-2026-86597: 1.4.5 to 4.7.2 (4.7.3 is outside it) - CVE-2026-85525: 1.4.5 to 4.7.2 (4.7.3 is outside it) - CVE-2026-15925: 1.4.5 to 3.18.0 (3.18.1 is outside it); 4.0.0 to 4.7.0 (4.7.1 is outside it) - CVE-2025-24795: 2.3.7 to 3.13.0 (3.13.1 is outside it) - CVE-2025-24794: 2.7.12 to 3.13.0 (3.13.1 is outside it) - CVE-2025-24793: 2.2.5 to 3.13.0 (3.13.1 is outside it) - CVE-2024-49750: 1.4.5 to 3.12.2 (3.12.3 is outside it) - CVE-2023-34233: 1.4.5 to 3.0.1 (3.0.2 is outside it) - CVE-2022-42965: 1.4.5 to 2.8.1 (2.8.2 is outside it) ## Advisories (12) ### [CVE-2026-123859](https://cve.now/CVE-2026-123859): SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) - Severity: High 8.1 - Published: Nov 6, 2026 - Affected: from 2.3.4, fixed in 4.8.1; from 5.0.0b1, fixed in 5.2.0. - Fixed in 4.8.1 (released Oct 26, 2026, 11 days before disclosure) and 5.2.0 (released Nov 4, 2026, 2 days before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2026-114456](https://cve.now/CVE-2026-114456): Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers - Severity: Medium 6.5 - Published: Nov 4, 2026 - Affected: fixed in 4.8.0. - Fixed in 4.8.0 (released Sep 30, 2026, 35 days before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2026-86600](https://cve.now/CVE-2026-86600): Workload identity attestation generated before login host validation in Snowflake drivers - Severity: High 8.2 - Published: Sep 8, 2026 - Affected: from 3.14.1, fixed in 4.7.3. - Fixed in 4.7.3 (released Sep 3, 2026, 5 days before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2026-86597](https://cve.now/CVE-2026-86597): Sensitive information written to logs by Snowflake drivers - Severity: Medium 6.5 - Published: Sep 8, 2026 - Affected: fixed in 4.7.3; fixed in 4.7.3. - Fixed in 4.7.3 (released Sep 3, 2026, 5 days before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2026-85525](https://cve.now/CVE-2026-85525): Improper OCSP response validation in Snowflake drivers - Severity: High 7.4 - Published: Sep 4, 2026 - Affected: fixed in 4.7.3. - Fixed in 4.7.3 (released Sep 3, 2026, 1 day before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2026-15925](https://cve.now/CVE-2026-15925): Improper TLS Hostname Verification in Snowflake Connector for Python - Severity: Critical 9.2 - Published: Jul 16, 2026 - Affected: fixed in 3.18.1; from 4.0.0, fixed in 4.7.1; fixed in 3.18.1; from 4.0.0, fixed in 4.7.1. - Fixed in 3.18.1 (released Jul 15, 2026, 1 day before disclosure) and 4.7.1 (released Jul 15, 2026, 1 day before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2025-24795](https://cve.now/CVE-2025-24795): The Snowflake Connector for Python uses insecure cache files permissions - Severity: Medium 4.4 - Published: Jan 29, 2025 - Affected: from 2.3.7, fixed in 3.13.1. - Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2025-24794](https://cve.now/CVE-2025-24794): The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache - Severity: Medium 6.7 - Published: Jan 29, 2025 - Affected: from 2.7.12, fixed in 3.13.1. - Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2025-24793](https://cve.now/CVE-2025-24793): Snowflake Connector for Python has an SQL Injection in write\_pandas - Severity: High 7.0 - Published: Jan 29, 2025 - Affected: from 2.2.5, fixed in 3.13.1. - Fixed in 3.13.1 (released Jan 29, 2025, the day of disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2024-49750](https://cve.now/CVE-2024-49750): Snowflake Connector for Python has sensitive data in logs - Severity: Medium 5.5 - Published: Oct 24, 2024 - Affected: fixed in 3.12.3. - Fixed in 3.12.3 (released Oct 24, 2024, the day of disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2023-34233](https://cve.now/CVE-2023-34233): Snowflake Python Connector vulnerable to Command Injection - Severity: High 7.3 - Published: Jun 8, 2023 - Affected: fixed in 3.0.2. - Fixed in 3.0.2 (released Mar 23, 2023, 77 days before disclosure). - The latest release, 5.2.0, is not affected. ### [CVE-2022-42965](https://cve.now/CVE-2022-42965): Exponential ReDoS in snowflake-connector-python leads to denial of service - Severity: Low 3.7 - Published: Nov 9, 2022 - Affected: fixed in 2.8.2. - Fixed in 2.8.2 (released Nov 19, 2022, 10 days after disclosure). - The latest release, 5.2.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/snowflake-connector-python Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.