Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · PYSEC-2026-4188

Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}....

CVSS 6.3 MediumEPSS 0.0043 · 37th percentile

Published by OSV at 29 Sept 2026, 10:17 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
apache-airflow-providers-snowflakePyPI<6.18.06.18.0
Identifiers
PYSEC-2026-4188 · CVE-2026-81930
Weakness (CWE)
CWE-522
Tags
Published
29 Sept 2026
Updated
8 Oct 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Apache Airflow's Snowflake provider (apache-airflow-providers-snowflake) before 6.18.0 does not validate the connection's account and region fields before building request URLs from them. A user who can edit a Snowflake connection, but cannot read its stored secrets, can cause an existing Dag using that connection to send a valid Snowflake token to a host of the attacker's choosing. Upgrade to apache-airflow-providers-snowflake 6.18.0 or later, which rejects account and region values containing characters other than letters, digits, dots, underscores and hyphens.

Written 1 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
6.3 Medium 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L OSV
  • CISA KEV Not listed.
  • EPSS 0.0043, the 37th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 31 Oct 2026, 14:08 UTC First seen by agentprime
  2. 31 Oct 2026, 14:08 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.