Read the docs
TI-2025-29068 Aliases CVE-2025-46327GHSA-6jgm-j7h2-2fqg

Go Snowflake Driver has race condition when checking access to Easy Logging configuration file

Priority LOW 30CWE-367Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00135 2nd percentileScored 2026-11-07
Fix Fixed gosnowflake (snowflakedb): 1.13.3github.com/snowflakedb/gosnowflake (Go): 1.13.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Snowflakegosnowflake1.7.0 to before 1.13.31.13.3Patch availableCNA
—github.com/snowflakedb/gosnowflake (Go)1.7.0 to before 1.13.31.13.3Patch availableGHSA-6jgm-j7h2-2fqg
  • gosnowflake VendorSnowflake Affected 1.7.0 to before 1.13.3 Fixed in 1.13.3 Patch available CNA
  • github.com/snowflakedb/gosnowflake (Go) Vendor— Affected 1.7.0 to before 1.13.3 Fixed in 1.13.3 Patch available GHSA-6jgm-j7h2-2fqg

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snowflake:gosnowflake:*:*:*:*:*:go:*:*1.7.0 to before 1.13.3VulnerableSnowflake
  • cpe:2.3:a:snowflake:gosnowflake:*:*:*:*:*:go:*:* Versions 1.7.0 to before 1.13.3 Vulnerable ·Snowflake

Remediation

  • Fix · CNA gosnowflake (snowflakedb) Fixed in 1.13.3
  • Fix · GHSA-6jgm-j7h2-2fqg github.com/snowflakedb/gosnowflake (Go) Fixed in 1.13.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-46327
  2. 2026-10-03 Alias added: GHSA-6jgm-j7h2-2fqg

References

Patch 1

Advisory 2

Other 2

  • TI-2023-17067 Snowflake Golang Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences