{"id":"CVE-2026-28381","aliases":["EUVD-2026-38244","GHSA-v3c5-p4mq-9369"],"status":"published","title":"Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT","description":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0035,"percentile":0.28834,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2026-06-22T13:20:29Z","modified":"2026-10-25T23:10:00Z","products":[{"vendor":"grafana","product":"snowflake"},{"vendor":"grafana","product":"snowflake datasource"}],"references":[{"url":"https://grafana.com/security/security-advisories/cve-2026-28381","tags":["vendor-advisory","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28381"},{"url":"https://github.com/advisories/GHSA-v3c5-p4mq-9369"}],"sources":{"cve":[{"id":"CVE-2026-28381","title":"Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT","description":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.","status":"published","published":"2026-06-22T13:20:29.44Z","modified":"2026-06-24T15:58:25.231Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:20:01.969981Z"}],"euvd":[{"id":"EUVD-2026-38244","description":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.","status":"published","published":"2026-06-22T13:20:29Z","modified":"2026-06-24T15:58:25Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T18:20:30.642628Z"}],"ghsa":[{"id":"GHSA-v3c5-p4mq-9369","title":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run...","description":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.","status":"published","published":"2026-06-22T15:30:43Z","modified":"2026-06-24T18:32:35Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:08:58.190411Z"}],"nvd":[{"id":"CVE-2026-28381","description":"The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected Snowflake host.","status":"published","published":"2026-06-22T14:16:35.82Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:12:24.912854Z"}]}}