Missing origin validation in Snowflake externalbrowser callback
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-346.
Summary
Multiple Snowflake client drivers implementing the externalbrowser single sign-on flow have a missing origin validation flaw (CWE-346) in the local loopback callback listener that receives the identity provider's response. The listener reflects an arbitrary request's Origin header into its CORS response headers and accepts the first token-bearing request during the login window without verifying a CSRF state value tied to that login attempt. An attacker who can reach the listener during an active login can submit a forged callback response and make the authentication attempt fail. The CVSS 3.1 base score is 6.5 (MEDIUM).
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
Description from the CNA
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Snowflake | Snowflake Connector for Python | before 4.8.0 | 4.8.0 | Patch available | CNA |
| Snowflake | Snowflake Go Driver | 1.1.5 – 1.19.1 | — | No fix listed | CNA |
| Snowflake | Snowflake Go Driver | 2.0.0 to before 2.3.0 | 2.3.0 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver | 3.2.3 to before 4.4.0 | 4.4.0 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver (FIPS) | 3.2.3 to before 4.4.0 | 4.4.0 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver (Thin) | 3.2.3 to before 4.4.0 | 4.4.0 | Patch available | CNA |
| Snowflake | Snowflake Node.js Driver | 1.6.0 to before 3.4.0 | 3.4.0 | Patch available | CNA |
| Snowflake | Snowflake Connector for .NET | 1.0.12 to before 6.3.0 | 6.3.0 | Patch available | CNA |
| Snowflake | Snowflake ODBC Driver | 3.7.0 to before 4.0.0 | 4.0.0 | Patch available | CNA |
| Snowflake | Snowflake PHP PDO Driver | 3.2.0 to before 4.3.0 | 4.3.0 | Patch available | CNA |
| Snowflake | Snowflake Libsnowflakeclient | 2.1.0 to before 2.11.1 | 2.11.1 | Patch available | CNA |
- Snowflake Connector for Python VendorSnowflake Affected before 4.8.0 Fixed in 4.8.0 Patch available CNA
- Snowflake Go Driver VendorSnowflake Affected 1.1.5 – 1.19.1 Fixed in — No fix listed CNA
- Snowflake Go Driver VendorSnowflake Affected 2.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available CNA
- Snowflake JDBC Driver VendorSnowflake Affected 3.2.3 to before 4.4.0 Fixed in 4.4.0 Patch available CNA
- Snowflake JDBC Driver (FIPS) VendorSnowflake Affected 3.2.3 to before 4.4.0 Fixed in 4.4.0 Patch available CNA
- Snowflake JDBC Driver (Thin) VendorSnowflake Affected 3.2.3 to before 4.4.0 Fixed in 4.4.0 Patch available CNA
- Snowflake Node.js Driver VendorSnowflake Affected 1.6.0 to before 3.4.0 Fixed in 3.4.0 Patch available CNA
- Snowflake Connector for .NET VendorSnowflake Affected 1.0.12 to before 6.3.0 Fixed in 6.3.0 Patch available CNA
- Snowflake ODBC Driver VendorSnowflake Affected 3.7.0 to before 4.0.0 Fixed in 4.0.0 Patch available CNA
- Snowflake PHP PDO Driver VendorSnowflake Affected 3.2.0 to before 4.3.0 Fixed in 4.3.0 Patch available CNA
- Snowflake Libsnowflakeclient VendorSnowflake Affected 2.1.0 to before 2.11.1 Fixed in 2.11.1 Patch available CNA
Remediation
Upgrade to Snowflake Connector for Python 4.8.0, Snowflake Go Driver 2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, or libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must upgrade manually.
Written with Claude Haiku 5.5 from the sources below · 2026-11-04
- Fix · CNA Snowflake Connector for Python (Snowflake) Fixed in 4.8.0
- Fix · CNA Snowflake Go Driver (Snowflake) Fixed in 2.3.0
- Fix · CNA Snowflake JDBC Driver (Snowflake) Fixed in 4.4.0
- Fix · CNA Snowflake JDBC Driver (FIPS) (Snowflake) Fixed in 4.4.0
- Fix · CNA Snowflake JDBC Driver (Thin) (Snowflake) Fixed in 4.4.0
- Fix · CNA Snowflake Node.js Driver (Snowflake) Fixed in 3.4.0
- Fix · CNA Snowflake Connector for .NET (Snowflake) Fixed in 6.3.0
- Fix · CNA Snowflake ODBC Driver (Snowflake) Fixed in 4.0.0
- Fix · CNA Snowflake PHP PDO Driver (Snowflake) Fixed in 4.3.0
- Fix · CNA Snowflake Libsnowflakeclient (Snowflake) Fixed in 2.11.1
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Snowflake Libsnowflakeclient, Snowflake PHP PDO Driver 2.11.1, 4.3.0
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-85037 Stack-based buffer overflow in Snowflake SAML authentication handlingPriority LOW 32
Timeline
- 2026-11-04 Threatist record created from CVE-2026-114456
- 2026-11-04 Alias added: GHSA-crcx-4c4m-p23p
- 2026-11-04 CISA SSVC decision points changed
- 2026-11-04 Priority changed: MEDIUM → LOW
References
Other 8
- Snowflake Connector for Python Release Notes
- Snowflake Go Driver Release Notes
- Snowflake JDBC Driver Release Notes
- Snowflake Node.js Driver Release Notes
- Snowflake Connector for .NET Release Notes
- Snowflake ODBC Driver Release Notes
- Snowflake PHP PDO Driver Release Notes
- Snowflake Libsnowflakeclient Release Notes
More Snowflake vulnerabilities
- TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
- TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
- TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
- TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
- TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
- TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
Sources
- CVE-2026-114456 · CVE Program
- CVE-2026-114456 · NVD
- FIRST EPSS
- GHSA-crcx-4c4m-p23p · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences