CVE-2026-19594

Name of the Vulnerable Software and Affected Versions Snowflake Python API (snowflake.core) versions prior to 1.13.0

Description Insufficient input sanitization allows confused-deputy privilege escalation through path traversal and HTTP parameter pollution. Path traversal occurs via unencoded .. identifier path segments, while HTTP parameter pollution occurs via unencoded &, #, or = characters in query string values. An attacker controlling an identifier or object-name string in a downstream application can cause the API to issue REST requests against parent resources or override constraints on swap, clone, or rename operations. These actions are executed under the application's privileged session, such as a Streamlit app, Native App, or an EXECUTE AS OWNER stored procedure.

Recommendations Update Snowflake Python API (snowflake.core) to version 1.13.0.