CVE-2026-81930

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-snowflake versions prior to 6.18.0

Description The Snowflake provider fails to validate the account and region fields of a connection before interpolating them into request URLs. This allows an attacker with permissions to edit the connection, but not read its secrets, to inject characters such as /, ?, or # into the account field. This manipulation changes the intended domain into a path, query, or fragment, granting the attacker control over the request host. Consequently, the provider may send an Authorization: Bearer header containing a JWT (JSON Web Token), an OAuth token, or a programmatic access token to a host controlled by the attacker, who can then replay it against the legitimate Snowflake endpoint. This issue affects the SQL API endpoint https://{account}.snowflakecomputing.com/api/v2/statements, the OAuth token-request URL, and the Cortex Agent base URL.

Recommendations Upgrade to apache-airflow-providers-snowflake version 6.18.0 or later.