CVE-2026-114456 Details
Description
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.
A vulnerability exists in multiple Snowflake client drivers that implement the 'authenticator=externalbrowser' single sign-on flow. This issue could have allowed an attacker to disrupt a user's login attempt by exploiting weaknesses in the local loopback callback listener, which is used to receive responses from the identity provider. The listener improperly handled the Origin header, accepted the first token-bearing request without verifying a CSRF state value, and failed to validate the Origin header against the connected Snowflake account endpoint. As a result, an attacker could have submitted a forged callback response during an active login, causing the authentication attempt to fail. This vulnerability affects several different versions and/or ranges of the Snowflake Connectors for Python, Go, JDBC, Node.js, .NET, ODBC, and PHP PDO.
Users must manually upgrade to the latest versions of the Snowflake client drivers. The patched versions are: Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0, Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 4, 2026CISA-ADP
Assessed Nov 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.snowflake.com/en/release-notes/clients-drivers/dotnet-2026#version-630-september-30-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-230-sep-30-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-440-sep-30-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-340-september-30-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-400-sep-30-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-430-oct-1-2026 | SNOWFLAKE | Release NotesVendor |
| https://github.com/snowflakedb/libsnowflakeclient/releases/tag/v2.11.1 | SNOWFLAKE | Source CodeVendor |
| https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.8.0 | SNOWFLAKE | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | SNOWFLAKE |
Affected Products
| Product | Versions |
|---|---|
| Snowflake Connector for Python | < 4.8.0 (semver) |
CPE
Remediation
| |
| Snowflake Go Driver | < 2.3.0 (semver) |
CPE
Remediation
| |
| Snowflake JDBC Driver | < 4.4.0 (semver) |
CPE
Remediation
| |
| Snowflake Node.js Driver | < 3.4.0 (semver) |
CPE
Remediation
| |
| Snowflake Connector for .NET | < 6.3.0 (semver) |
CPE
Remediation
| |
| Snowflake ODBC Driver | < 4.0.0 (semver) |
CPE
Remediation
| |
| Snowflake PHP PDO Driver | < 4.3.0 (semver) |
CPE
Remediation
| |
| Snowflake libsnowflakeclient | < 2.11.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 4, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2026 | New CVE Received | SNOWFLAKE |