Snowflake Connector for Python Local Loopback Callback Listener cross-site request forgery

Summaryinfo

A vulnerability was found in Snowflake Connector for Python, Go Driver, JDBC Driver, Node.js Driver, Connector for .NET, ODBC Driver, PHP PDO Driver and Libsnowflakeclient. It has been rated as problematic. This issue affects some unknown processing of the component Local Loopback Callback Listener. The manipulation leads to cross-site request forgery. This vulnerability is traded as CVE-2026-114456. It is possible to initiate the attack remotely. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Snowflake Connector for Python, Go Driver, JDBC Driver, Node.js Driver, Connector for .NET, ODBC Driver, PHP PDO Driver and Libsnowflakeclient. This issue affects an unknown function of the component Local Loopback Callback Listener. The manipulation with an unknown input leads to a cross-site request forgery vulnerability. Using CWE to declare the problem leads to CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Impacted is integrity. The summary by CVE is:

Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-114456 since 10/21/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• Snowflake

Name

• Connector for .NET
• Connector for Python
• Go Driver
• JDBC Driver
• Libsnowflakeclient
• Node.js Driver
• ODBC Driver
• PHP PDO Driver

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion