CVE-2026-114456: Snowflake client drivers CORS and CSRF in externalbrowser SSO

CVE-2026-114456 · Severity: medium · CVSS 6.5 · Published 2026-11-04

Multiple Snowflake database client libraries implementing external browser-based single sign-on contained weaknesses in how they handled identity provider responses during login. An attacker positioned to intercept network traffic during an active login could forge a callback response to disrupt the authentication attempt. This could prevent legitimate users from accessing their Snowflake databases, though the attacker cannot gain unauthorized access themselves.

Technologies: Snowflake Connector for Python, Snowflake Go Driver, Snowflake JDBC Driver, Snowflake Libsnowflakeclient, Snowflake Node.js Driver, Snowflake ODBC Driver, Snowflake PHP PDO Driver. Vendors: Snowflake.

Quick answers

Is CVE-2026-114456 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-114456 being exploited in the wild.
How severe is CVE-2026-114456?
Medium severity, with a CVSS score of 6.5, published 4 November 2026.
Which products and versions are affected?
Snowflake Connector for .NET before 6.3.0; Snowflake Connector for Python before 4.8.0; Snowflake Go Driver before 2.3.0; v1 requires migration to latest; Snowflake JDBC Driver before 4.4.0; and 4 more.
Is there a fix for CVE-2026-114456?
Yes: fixed in Snowflake Connector for Python 4.8.0, Snowflake Go Driver 2.3.0, Snowflake JDBC Driver 4.4.0, Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, libsnowflakeclient 2.11.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114456 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-114456?
Check whether you run Snowflake Connector for .NET, Snowflake Connector for Python, Snowflake Go Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Snowflake Connector for Python 4.8.0, Snowflake Go Driver 2.3.0, Snowflake JDBC Driver 4.4.0, Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, libsnowflakeclient 2.11.1

Technical details

The vulnerability exists in the local loopback callback listener that receives responses from the identity provider during the externalbrowser authentication flow. The listener reflects the Origin header from arbitrary requests into CORS response headers without validation and accepts the first token-bearing request without verifying a CSRF state value bound to the specific login session. An attacker with network access to the listener during an active login can submit a forged callback to cause authentication failure.

Affected products

  • Snowflake Connector for Python before 4.8.0
  • Snowflake Go Driver before 2.3.0; v1 requires migration to latest
  • Snowflake JDBC Driver before 4.4.0
  • Snowflake Node.js Driver before 3.4.0
  • Snowflake Connector for .NET before 6.3.0
  • Snowflake ODBC Driver before 4.0.0
  • Snowflake PHP PDO Driver before 4.3.0
  • Snowflake libsnowflakeclient before 2.11.1

Timeline

  • 2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.