CVE-2026-19594: Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 allowed confused-dep
Summary
A vulnerability in Snowflake Python API (a library for connecting to Snowflake databases) versions before 1.13.0 allowed attackers to bypass security restrictions through two methods: path traversal (using `..` to access parent resources) and HTTP parameter pollution (injecting special characters like `&`, `#`, `=` to change how requests are interpreted). An attacker who could control certain input values in an application using this library could trick it into executing privileged operations under a higher-permission user account.
Solution / Mitigation
"The fix is available in Snowflake Python API version 1.13.0, which also addresses several additional security findings. Users must manually upgrade."
Vulnerability Details
8.1(high)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
network
low
low
none
August 12, 2026
Classification
Taxonomy References
Affected Vendors
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-19594
First tracked: August 12, 2026 at 08:08 AM
Classified by LLM (prompt v3) · confidence: 72%