CVE-2026-28381

The Snowflake datasource in Grafana supports GET and PUT commands, which are used for file transfers between the local server and the Snowflake host. This mechanism is not properly restricted in terms of permissions — any user with access to run queries on this data source can use these commands to read or write any files accessible to the Grafana process on the local server. Lack of proper access control (CWE-284) causes file operations to exceed the intended scope of user permissions.

An attacker can read potentially sensitive files from the local Grafana server (e.g., configuration files, credentials) and write their own files to it, which may lead to privilege escalation or further infrastructure compromise. High impact on confidentiality (C:H) and integrity (I:H) with scope change (S:C) makes this vulnerability critical.

Apply patches available from the vendor according to references (https://grafana.com/security/security-advisories/cve-2026-28381). Until updates are applied, it is recommended to restrict access to Snowflake datasource only to trusted and necessary users, and monitor query activity for use of GET/PUT commands.

Grafana installations using Snowflake datasource where users have permissions to execute queries on this data source. Specific versions indicated in vendor references.