CVE-2026-19594: Snowflake Python API Privilege Escalation

CVE-2026-19594 Overview

CVE-2026-19594 is an input sanitization flaw in the Snowflake Python API (snowflake.core) affecting all versions prior to 1.13.0. The vulnerability combines two weaknesses: path traversal ([CWE-22]) through unencoded .. identifier path segments, and HTTP parameter pollution ([CWE-141]) through unencoded &, #, and = characters in query string values. Attackers who control identifier or object-name strings in downstream applications built on snowflake.core can escalate privileges through a confused-deputy pattern. Exploitation executes under the application's higher-privileged Snowflake session, such as an EXECUTE AS OWNER stored procedure, Streamlit app, or Native App.

Critical Impact
Attackers can escalate privileges and manipulate parent resources or override swap, clone, and rename operations under a privileged Snowflake session, compromising data integrity and availability.

Affected Products

Snowflake Python API (snowflake.core) versions prior to 1.13.0
Downstream applications built on snowflake.core that accept user-controlled identifiers
Streamlit apps, Native Apps, and EXECUTE AS OWNER stored procedures using snowflake.core

Discovery Timeline

2026-08-12 - CVE-2026-19594 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19594

Vulnerability Analysis

The Snowflake Python API snowflake.core fails to sanitize identifier and object-name inputs before constructing REST API requests. This creates two exploitable paths that both rely on a confused-deputy pattern where a low-privileged attacker abuses a higher-privileged application session.

The first weakness allows path traversal. When an attacker supplies .. as an object name, snowflake.core incorporates the unencoded segment directly into the REST resource path. The resulting request targets a parent resource rather than the intended child object, granting the attacker access outside the intended scope.

The second weakness allows HTTP parameter pollution. When an attacker injects &, #, or = characters into a free-form name field, snowflake.core places these unencoded characters into the query string. The injected metacharacters split or extend query parameters, overriding constraints on swap, clone, or rename operations.

Root Cause

The root cause is missing URL encoding on user-controlled string values used in REST path segments and query parameters. The library trusts caller-supplied identifiers and does not enforce character allowlists or percent-encoding before request construction.

Attack Vector

Exploitation requires the attacker to control an identifier or object-name string passed to snowflake.core under a session with elevated privileges. Common target contexts include EXECUTE AS OWNER stored procedures, Streamlit applications, and Native Apps that expose object names to end users. The attacker submits crafted identifiers containing .. or &/#/= metacharacters through the downstream application. snowflake.core then issues REST requests that either traverse to parent resources or override operation parameters under the application owner's session. See the PyPI Snowflake Core Release notes for additional technical context.

Detection Methods for CVE-2026-19594

Indicators of Compromise

Snowflake query history entries showing swap, clone, or rename operations on unexpected objects executed by application-owned roles
Application logs containing user-supplied identifier values with .., &, #, or = characters
Anomalous access to parent schemas or databases from EXECUTE AS OWNER procedures

Detection Strategies

Inspect application input validation layers for missing allowlists on Snowflake identifier fields
Audit snowflake.core package versions across development and production environments to identify installations below 1.13.0
Review Snowflake ACCESS_HISTORY and QUERY_HISTORY views for object references that deviate from expected application scope

Monitoring Recommendations

Enable Snowflake access logging and forward events to a centralized analytics platform for correlation
Alert on stored procedures and Native Apps performing operations on objects outside their declared namespace
Track dependency inventories to detect any downgrade or pin to vulnerable snowflake.core versions

How to Mitigate CVE-2026-19594

Immediate Actions Required

Upgrade snowflake.core to version 1.13.0 or later in all environments; the upgrade is manual and not automatic
Enumerate Streamlit apps, Native Apps, and stored procedures that accept user-controlled identifiers and prioritize their remediation
Add server-side validation to reject identifier inputs containing .., &, #, or = characters

Patch Information

Snowflake released the fix in Snowflake Python API version 1.13.0. The release also addresses several additional security findings. Users must manually upgrade the package; see the PyPI Snowflake Core Release page for installation details.

Workarounds

Enforce strict identifier allowlists limited to [A-Za-z0-9_] in application code before invoking snowflake.core
Restrict privileges on EXECUTE AS OWNER procedures to the minimum object scope required
Deploy WAF or application-layer filters that reject Snowflake object-name parameters containing path or query metacharacters

bash

# Upgrade snowflake.core to the patched release
pip install --upgrade 'snowflake.core>=1.13.0'

# Verify installed version
python -c "import snowflake.core; print(snowflake.core.__version__)"