CVE-2026-28381 — Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

CVE-2026-28381

Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT PUBLISHED

Description (CNA)

The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.

Affected (CNA)

Vendor / product	Versions
Grafana / Snowflake Datasource	affected 1.14.7 through 1.14.12

CWE

No CWE identifiers supplied.

References

https://grafana.com/security/security-advisories/cve-2026-28381

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.