# CVE-2026-19594: Snowflake Python API path traversal and parameter pollution privilege escalation

Source: https://junglewise.ai/threats/cve-2026-19594-snowflake-python-api-path-traversal-and-parameter-pollution  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-19594 · Severity: high · CVSS 8.1 · Published 2026-08-12

Snowflake's Python API library contains two input validation flaws that allow attackers to bypass access controls on cloud database operations. An attacker who can supply data to an application built on this library can manipulate API requests to access resources outside their permission level or modify operations (such as cloning or renaming databases) in unintended ways. This risk is especially acute when the library is used in high-privilege contexts like stored procedures or Streamlit applications.

Vendors: [Snowflake](https://junglewise.ai/threats/vendors/snowflake).

## Quick answers

**Is CVE-2026-19594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19594 being exploited in the wild.

**How severe is CVE-2026-19594?** High severity, with a CVSS score of 8.1, published 12 August 2026.

**Which products and versions are affected?** Snowflake Python API prior to 1.13.0.

**Is there a fix for CVE-2026-19594?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19594 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19594?** Check whether you run Snowflake Python API at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability consists of two related weaknesses in Snowflake Python API (`snowflake.core`) versions before 1.13.0: path traversal (CWE-22) via unencoded `..` segments in identifier paths, and HTTP parameter pollution (CWE-141) via unencoded special characters (`&`, `#`, `=`) in query string values. An attacker with control over object names or identifiers passed to the library can craft requests to traverse to parent resources or inject parameters that override operation constraints (e.g., on swap, clone, or rename operations). Exploitation requires the application to run under a higher-privileged Snowflake session, such as EXECUTE AS OWNER in a stored procedure, Streamlit app, or Native App. The fix is available in version 1.13.0 and requires manual upgrade.

## Affected products

- Snowflake Python API prior to 1.13.0

## Timeline

- 2026-08-12: disclosed

## References

- [https://pypi.org/project/snowflake.core/1.13.0/](https://pypi.org/project/snowflake.core/1.13.0/)