CVE-2026-1144566.5MediumCWE-346

CVE-2026-114456: Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers

Snowflake · Snowflake Connector for Python

Vendor fix available · Affected: Snowflake Connector for Python · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.2%probability of exploitation in the next 30 days

12th percentile

050100

Higher than 12% of scored CVEs

6.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.

Affected products11

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Snowflake · Snowflake Connector for Pythonbefore 4.8.0
Snowflake · Snowflake Go Driverfrom 1.1.5 up to and including 1.19.1
Snowflake · Snowflake Go Driverfrom 2.0.0 before 2.3.0
Snowflake · Snowflake JDBC Driverfrom 3.2.3 before 4.4.0
Snowflake · Snowflake JDBC Driver (FIPS)from 3.2.3 before 4.4.0
Snowflake · Snowflake JDBC Driver (Thin)from 3.2.3 before 4.4.0
Snowflake · Snowflake Node.js Driverfrom 1.6.0 before 3.4.0
Snowflake · Snowflake Connector for .NETfrom 1.0.12 before 6.3.0
Snowflake · Snowflake ODBC Driverfrom 3.7.0 before 4.0.0
Snowflake · Snowflake PHP PDO Driverfrom 3.2.0 before 4.3.0
Snowflake · Snowflake Libsnowflakeclientfrom 2.1.0 before 2.11.1

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Origin Validation Error · Access Control
Vendor: Snowflake
Published: November 2026
Band: Unlikely (under 1%), November 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-114456 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.