CVE-2026-28381: Snowflake Datasource Auth Bypass Flaw

CVE-2026-28381 Overview

CVE-2026-28381 affects the Grafana Snowflake datasource plugin. The datasource permits GET and PUT commands within queries, enabling any user with query access to read or write files between the local Grafana server and the connected Snowflake host. The vulnerability falls under improper access control [CWE-284] and carries a CVSS 3.1 score of 9.6.

Critical Impact
Authenticated Grafana users with query permissions can exfiltrate files from the Grafana server or stage arbitrary content to the Snowflake host, breaching the trust boundary between the visualization layer and the data warehouse.

Affected Products

Grafana Snowflake datasource plugin
Grafana deployments integrating Snowflake as a data source
Self-hosted and Grafana Cloud instances exposing the Snowflake plugin to query-capable users

Discovery Timeline

2026-06-22 - CVE-2026-28381 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-28381

Vulnerability Analysis

The Grafana Snowflake datasource accepts user-supplied SQL and forwards it to the connected Snowflake account. Snowflake's SQL dialect includes the GET and PUT client-side commands that move files between the local file system of the executing client and Snowflake internal stages. Because the Grafana plugin executes queries with the privileges of the Grafana server process, the local file system referenced by GET and PUT is the Grafana host itself, not the requesting browser user.

Any Grafana user with permission to issue queries against the Snowflake datasource can therefore read sensitive files from the Grafana server, such as configuration files containing secrets, or stage attacker-controlled files into a Snowflake stage and pull them back to the Grafana server filesystem. This crosses the security boundary between a low-privileged Grafana viewer or editor and the underlying host operating system, as reflected in the changed scope of the CVSS vector.

Root Cause

The root cause is missing command filtering in the Snowflake datasource plugin. The plugin passes user input directly to the Snowflake driver without restricting the statement type to SELECT or other read-only operations. The GET and PUT commands operate on the server's local filesystem with the Grafana service account's privileges, violating the principle of least privilege.

Attack Vector

An authenticated Grafana user with access to the Snowflake datasource crafts a query containing PUT file:///etc/grafana/grafana.ini @~/stage to upload a file from the Grafana server to a Snowflake user stage. The attacker then issues GET @~/stage/grafana.ini file:///tmp/ to retrieve it, or uses PUT to drop malicious content into writable directories on the Grafana host. No browser-level user interaction or additional privilege escalation is required. Full technical details are available in the Grafana Security Advisory.

Detection Methods for CVE-2026-28381

Indicators of Compromise

Snowflake query history entries containing PUT file:// or GET @ statements originating from the Grafana service user
Unexpected files appearing in Grafana server directories such as /tmp, /var/lib/grafana, or plugin paths
Outbound staging activity to Snowflake internal stages (@~, @%, or named stages) from Grafana sessions
Grafana audit log entries showing query execution against the Snowflake datasource by non-administrative users

Detection Strategies

Parse Snowflake QUERY_HISTORY for statements matching ^\s*(GET|PUT)\s executed by the service account bound to Grafana
Alert on Grafana datasource queries containing the substrings file://, PUT @, or GET @ in proxy or reverse-proxy access logs
Correlate Grafana user sessions with Snowflake query timestamps to attribute file-transfer commands to specific Grafana accounts

Monitoring Recommendations

Enable Snowflake account-level query logging and forward QUERY_HISTORY events to your SIEM
Monitor file integrity on the Grafana server for unexpected writes in plugin and configuration directories
Track Grafana datasource permission changes and audit which users hold Query rights on the Snowflake datasource

How to Mitigate CVE-2026-28381

Immediate Actions Required

Upgrade the Grafana Snowflake datasource plugin to the patched version listed in the Grafana Security Advisory
Restrict the Snowflake datasource to administrators until the patch is applied
Rotate any secrets, API tokens, or credentials that may have been readable on the Grafana server filesystem
Review Snowflake QUERY_HISTORY for the last 90 days for GET or PUT statements issued by the Grafana service user

Patch Information

Grafana Labs published remediation guidance in the official advisory at Grafana Security Advisory CVE-2026-28381. Apply the vendor-supplied plugin update, which restricts the datasource to non-file-transfer SQL statements.

Workarounds

Configure the Snowflake role used by Grafana with the minimum privileges required and revoke access to stages where possible
Run the Grafana process as an unprivileged user with no read access to sensitive configuration files or secrets on disk
Use network segmentation to ensure the Grafana host cannot be used as a pivot point if file write occurs
Disable the Snowflake datasource for any organization or team that does not require it

bash

# Audit Snowflake query history for GET/PUT abuse from the Grafana service user
snowsql -q "SELECT user_name, query_text, start_time \
  FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY \
  WHERE user_name = 'GRAFANA_SVC' \
    AND (query_text ILIKE '%PUT %' OR query_text ILIKE '%GET %') \
    AND start_time > DATEADD(day, -90, CURRENT_TIMESTAMP());"