Critical severity9.6NVD Advisory· Published Jun 22, 2026· Updated Jun 30, 2026

CVE-2026-28381

Description

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

Affected products

Grafana/Snowflake
cpe:2.3:a:grafana:snowflake:*:*:*:*:*:*:*:*
Range: >=1.14.7,<=1.14.12
Grafana/Grafana Snowflake Datasourcellm-fuzzy

Patches

Vulnerability mechanics

References

grafana.com/security/security-advisories/cve-2026-28381nvdBroken Link

News mentions

No linked articles in our index yet.

cvss	0.624
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000